I do IT

windows 7 bootable USB

2009-05-01T07:01:00.001-07:00

Don't forget, you can extract the Windows 7 iso onto a bootable USB. Makes the install much quicker:

1. diskpart

2. select disk 1 (if disk 1 is your USB stick)

3. clean

4. create partition primary

5. select partition 1

6. active

7. format fs=fat32 (ntfs also works).

8. assign

9. exit

10. Extract the ISO

11. xcopy d:\*.* /s/e/f e:\ (Copy Windows 7 iso content to the Flash Drive E:)

Windows 7 RC is on MSDN now

2009-04-30T07:51:00.001-07:00

If you have access to MSDN, go grab it! Remember that your February Beta keys will still work. If you need to regenerate them then these instructions will help:

http://www.neowin.net/news/main/09/01/10/psstheres-how-to-get-your-windows-7-beta-key

ConfigMgr.next revealed at MMS09

2009-04-29T18:40:00.001-07:00

The MMS09 State of the Union session revealed what the next version of SCCM will look like. The MMC is gone in favor of the Outlook-esqe toolbar (wonder-bar) as seen in SCOM 2007. It also requires Server 2008 64-bit as well as SQL 2008 64-bit. The other big piece of news is the elimination of ASP web reports in favor of SQL Server reporting services only. See all the screen shots and read more about it on Kenneth van Surksum's blog:

http://www.techlog.org/archive/2009/04/29/mms_2009_information_about_mic

Vista SP2 and Server 08 SP2 RTM'd

2009-04-29T07:29:00.001-07:00

SP2 for vista and server 08 have gone RTM. Additionally the block offering SP1 is being removed (your GPO to block SP1 will no longer work).

http://windowsteamblog.com/blogs/windowsvista/archive/2009/04/28/windows-vista-sp2-rtm-windows-vista-sp1-blocker-tool-removed.aspx

All the SP2 goodness can be found here:

http://technet.microsoft.com/en-us/windows/dd767387.aspx

Office 2007 SP2 is out

2009-04-29T07:05:00.001-07:00

Just released:

http://www.microsoft.com/downloads/details.aspx?FamilyID=b444bf18-79ea-46c6-8a81-9db49b4ab6e5&displaylang=en

time to download, test and deploy!

windows 7 will have near complete xp compatibility

2009-04-25T09:53:00.001-07:00

A new feature being announced is XP mode for Windows 7. XP mode is essentially an application running in a Virtual PC virtual environment. Installing the application in the virtual pc environment will result in it being published to windows 7 as an application. The requirements for this technology includes processor virtualization support (Intel VT or AMD-V). It will be a separate out of band update released in final form to coincide with the release of windows 7 (so it's not actually built in). Paul Thurrott has a nice set of screen shots on the whole thing here: http://www.winsupersite.com/win7/xp_mode_pre_shots.asp

Unable to import AI license file

2009-01-19T08:00:00.000-08:00

So our software licensing team asked about using SCCM's Asset Intelligence to track software license usage at our company. After going through all of our normal internal testing we were ready to import our xml formated license file into our site. However when we tried to import it on our production server we received a single message:

error

Unable to connect to the site database

Not very useful since my console and site server were obviously talking to the site database just fine. I spent many hours troubleshooting this one myself before calling Premier support. At which time I spent many more hours troubleshooting on the phone with them and fearing that the issue would be unresolved. We went through all kinds of troubleshooting of both my SQL server setup and my site server setup.

The only error message with any meaning behind it was when we tried to run the import manually:

D:\SMSPROV\bin\i386>mvlsimport.exe /file //server/share/MSLtest.xml

Failed to get Site Database configuration information.Failed to get Site Database connection.Failed to intialize.

Yes, those are forward slashes, per explicit instructions by Microsoft Support.

My gut told me it was a bug in SCCM, but how my site differed eluded both me and Microsoft support. Ultimately, by sheer luck a stumbled across the steps that would enable me to reproduce the bug on my own. My site had an unrelated hardware failure and I had to rebuild and recover it. As I rebuilt it I tried the import several times along the way, until it finally failed. Once I was able to reproduce the bug I let Microsoft know how my site differed from a working site. Turns out there is a bug importing the license file if the smsprovider is installed on another computer other than the site server. Support was then finally able to confirm that this was a bug that they could reproduce and would notify the development team. In the absence of an actual fix, they provided me with a workaround. The workaround is to export the sql node of the sms registry key from the site server and import it onto the smsprovider computer. If you are switching architecture you will have to update the key to compensate for wow6432node as well.

Export this key from your 32-bit site server: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\SQL Server]

Import this key into your 32-bit smsprovider computer.

Or, if your provider is 64-bit, find and replace \software\Microsoft\ with \software\wow6432node\Microsoft

Key will now be in this format:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\SMS\SQL Server]

Now import the new key onto your 64-bit smsprovider computer.

wsutil to change your wsus server's ports

2009-01-15T05:52:00.001-08:00

Following up on my recovery of a sccm site. My original recovery doc did not specify that during the wsus install, wsus needs to be setup to use its own custom website on ports 8530 (for http) and 8531 (for https). I later found that if you miss this step (When you notice your site fails to sync with its wsus database) then there is a simple utility installed with wsus that will allow you to change it. From the command line:

wsusutil.exe usecustomwebsite true

Also, if your site just isn't syncing for no apparent reason, I've found that a wsus reset may help:

wsusutil.exe reset

You can find wsutil on the wsus server in the program files\Update Services\Tools folder.

Chrome on Windows 7 64-Bit Beta (7000)

2009-01-12T07:10:00.001-08:00

This weekend I installed the current windows 7 64-bit beta (build 7000). All my favorite apps installed just fine including the SCCM console. I even managed to find a beta build of the rsat tools: http://www.microsoft.com/downloads/details.aspx?FamilyID=82516c35-c7dc-4652-b2ea-2df99ea83dbb&displaylang=en The only thing that I spent a significant amount of work getting to run was google chrome. I'm still in love with it, and just started using the 2.0 dev beta. So of course I want to run it on top of my windows 7 beta. Well now you can. In the target part of your shortcut to chrome.exe add -in-process-plugins. It runs just fine now. Credit to: BlogsDNA

Oh by the way, windows 7 boots faster on the same machine I was previously running vista 64!

Recovery of SCCM Site Failure

2009-01-09T06:35:00.001-08:00

Despite the fact that Microsoft has recovery information posted in their online support docs ( http://technet.microsoft.com/en-us/library/bb680474.aspx), site recovery is still a confusing task. I've gone through several site recoveries and here are the notes from my last one, where the central site happened to fail. An important note that I don't think is explained very well is that you have to have a functioning site setup the same way as the old site before you can recover the old site.

So before starting the site recovery review the original site setup procedure. If you don't have one documented, then see the excellent write up by Ying Li: http://myitforum.com/cs2/blogs/yli628/archive/2008/06/25/setup-configmgr-2007-sp1-from-start-to-finish.aspx

Notes from recovery of Central site on 12/17/08.

1. OS, Server name, Site Code, and Drive layout (OS on C: and program files on drive d: ) should match original hardware. (Do not move from 64-bit to 32-bit OS).

2. Install the OS and configure as normal

3. Give the machine account admin rights on the SQL server

4. Install WSUS 3.0 with SP1. Do not use the default website. Use custom website. During install point it to the remote SQL server (if you use a remote sql server to host wsus metadata). Do not overwrite the contents of the database. Do not use the configuration wizard to setup wsus. Simply exit when the configuration wizard starts.

5. Start copying the backup files to the local machine since it can take 1/2 hour.

6. Install the correct version of SCCM

a. Make sure to reuse the same program path (d:\sms for our Primary sites since they were upgrades from sms. d:\sccm for our Secondary sites, since they were fresh installs when we set them up). This part is critical. When you do the recovery step, your site will to use the original setup paths that were in use prior to the site failure. Changing the paths will cause a significant headache!

b. On a new fully patched system you will not pass the prereq check. Double click on each item to see how to resolve the issue. You should be able to resolve every error.

c. After resolving the MMC sp3 issue, it will still show up as an warning in prereq check, that is fine if you are sure you have applied sp3 for MMC. The setup routine does not correctly query the registry to see that lastest version of the hotfix that Microsoft issued.

d. You can ignore the warning about SQL server authentication mode if you typically run SQL under the system account (without hardening SQL).

e. If you are attempting to restore a site that has a remote provider and point it back to the correct remote provider machine, the installer will complain that machine already has a provider.

1. On the provider machine, the registry key is blocking the install of the new remote provider, so remove the HKLM\SOFTWARE\Microsoft\SMS\Providers key.

2. On the provider machine, connect to root\sms with WBEMTEST and press the 'Enum Classes button'. No input is necessary, just press 'OK' to do an 'Immediate only' search. In the Query Results dialog window, click on the 'SMS_ProviderLocation' and press the 'Delete' key. Close out of all of these dialogs.

3. Delete the SMSPROV folder on the root.

4. Add the new site server machine as a local administrator and remove the old site server (if applicable).

Note: Provider fix, pasted from http://social.technet.microsoft.com/forums/en-US/configmgrsetup/thread/bb307748-7638-404d-a6a4-982827a051c8/

f. All other site servers will install the provider on themselves.

g. On the SQL DB server detach the old DB. Create a new DB with the same name and file locations. Give the smssite server db_owner on the db.

7. After the install has completed successfully run the site recovery wizard.

a. Close the console if open

b. Start>all programs>Microsoft System Center>Config Mgr 2007>Config Mgr Site Repair Wizard

c. Redsite and ROSsite do not have local DP's installed. Choose the option to skip package verification.

8. Reset permissions for site in AD.

a. Open AD users and Computers> System> System Management

b. Open properties and give site server full control on Systems Management container.

c. Open advance properties and change permissions so that they apply to "This object and all descendant objects" (this is not the default so be sure to do it).

9. Restore the site control file

a. Copy site_control_files sitectrl_<SiteCode>.ct0 to D:\sms\inboxes\sitectrl.box

b. Rename file from sitectrl_<SiteCode>.ct0 to sitectrl.ct0

10. After recovery perform a site reset

a. Rerun setup from Start>all programs>Microsoft System Center>Config Mgr 2007>

b. Choose site reset

11. Set user group permissions for recovered site and related site servers

a. Computer mgmt>local users and groups>Groups

b. Sms_sitetositeconnection_<sitecode> should contain the parent server and any child servers that need to connect to the site.

c. Sms_siteSystemtoSiteServer_<sitecode> should contain any parent or child site that needs to write to the site's DB.

d. Sms Reporting Users should contain any domain accounts that have reporting rights.

e. Sms admins should contain your sms administrators domain accounts.

12. If this was the central site with the wsus updates, then the wsus updates folders need to be reshared with the same share names. Check the software updates deployment packages nodes. On each package open the package properties. The general tab will show the share name that the packages is expected to be found on. The central site's machine account will need full control of this share.

13. Reset the wsus db:

a. From the cmd prompt: c:\program files\Update Services\tools\wsusutil.exe reset

b. Wait 1 hour

c. Force a Synchronization on the Update Repository

d. Verify wsus is syncing properly: wsyncmgr.log for errors.

14. Verify backup share permissions for newly restored site. Our backups are set for a share on another server, which is then backed up to tape. This can be verified in the site maintenance node and by reviewing the smsbkup.log located in the backup share.

15. If this was the central site, recreate the backup schedule for the site control file. A scheduled task that runs every 15 mins to dump the site control file and copy them to another machine:

a. site_control_file_backup.bat

D:\sms\bin\i386\00000409\preinst.exe /Dump

xcopy d:\*.ct0 backup_location\site_control_files /C /Y

16. Check and review system logs for errors for the next several days.

17. Monitor Site Status for errors. The only errors should be on the central site and be related to unapproved clients trying to get policy. Recheck in 24 hours.

18. Verify successful backups by reviewing the smsbkup.log located in the backup share.

Config Manager Usability Study

2008-12-10T07:42:00.001-08:00

Microsoft is conducting a usability study for the next version of SCCM. If your in the Redmond area and available Jan 12-23rd you can participate. To join send an email to itusable@microsoft.com. Put ConfigMgr in the subject line: Source

Client Health Check Script- Take 2

2008-12-01T08:00:00.000-08:00

In final testing of the Client Health Check Script, I found that ccmsetup doesn't finish running the install during machine startup on any XP machine that I tested. I spent over 16 hours trying to figure out why before going with an alternative solution. Instead of running ccmsetup during machine startup, I now create a system scheduled task to run ccmsetup 5 minutes in the future. Since it's a one time task it cleans itself up. Here is the modified script:

Attached: Download

'==========================================================================
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.0
'
' NAME: SCCM_Client_Health_Check.vbs
' AUTHOR: Bill Phillips , ESRI
' DATE  : 10/20/2008
'
' COMMENT: Code rewrite for SCCM client taken from 1E ClientHealth Script for SMS client
' Run sccm_client_health_check.vbs /smsserver:smsserver /email:1stemail@company.com /email1:2ndemail@company.com
'==========================================================================
On Error Resume Next

        Dim smsserver, platform, email
        Dim domainrole, ComSpec, diffdate, enddate, fso, filedate, SmsClient, returncode, Results
        Dim ISmsClient, DiscoveredSite, AssignedSite
        Dim servicename, startdate, strMessage, strSMSPolEval, windir, wmi, colItems, wShShell, Compname, present, objShare
        Dim BitsVersion, tempdir, logfile, logsize
            
        Set WshShell = WScript.CreateObject("WScript.Shell")
        WinDir = WshShell.ExpandEnvironmentStrings("%windir%")
        Compname = WshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")
        ComSpec = WshShell.ExpandEnvironmentStrings("%COMSPEC%")
        tempdir = WshShell.ExpandEnvironmentStrings("%temp%")
        
        'Set up the loggong
        Set fso = CreateObject("Scripting.FileSystemObject")
        Set logfile = fso.OpenTextFile(tempdir & "\SCCM_Client_Health_Check.Log",2,True)
        
    
        
       logfile.writeline "####################################"
       logfile.writeline "Begining SCCM Client Health Check Script"
       logfile.writeline "####################################"
   
'********************************************************HARD CODED COMMAND LINE 

OVERRIDES********************************************************    
'***********************************************************UNCOMMENT ONLY IF 

NECESSARY***********************************************************
'smsserver = "smsserver" 'Should reflect the PMP/PDP for each office
'platform = "" 'No need to modify
'Email = "wphillips@company.com" 'Should be set to go to an alias that includes the needed peoeple.
'********************************************************HARD CODED COMMAND LINE 

OVERRIDES********************************************************    
'***********************************************************UNCOMMENT ONLY IF 

NECESSARY***********************************************************
checkSCCMserverCMD()
checkPlatformCMD()
checkEmailCMD()
checkEmail1CMD()
checkAdminShare()
checkCCMSetupRunning()
checkClient()
checkLogsUpdate()
checkBITSversion()
checkServices()
checkAssignment()
    logfile.writeline "Cleaning Up"
Call Cleanup
    logfile.writeline "Ending Processing"
WScript.Quit


'Check to see if SCCM server is specifed as an argument or hardcoded into script
Function checkSCCMserverCMD()
On Error Resume Next
        If smsserver = "" Then           
            If Wscript.Arguments.Named.Exists("smsserver") Then
              If Wscript.Arguments.Named("smsserver") <> "" Then
                logfile.writeline "smsserver specified in command line is " & WScript.Arguments.Named("smsserver")
              Else
                logfile.writeline "/smsserver parameter is the incorrect format. Please see documentation"
                  WScript.Quit
              End If
            Else
                 logfile.writeline "Missing /smsserver: in command line"
                  WScript.Quit
            End If
        Else
            logfile.WriteLine "The SCCMserver hardcoded command line override specified as = " & smsserver
        End If
End Function

Function checkPlatformCMD()
On Error Resume Next
logfile.writeline "CheckingPlatformCMD"
        If platform = "" Then
              domainrole = GetDomainRole()
            If Wscript.Arguments.Named.Exists("platform") Then
                  If Wscript.Arguments.Named("platform") <> "" Then
                      platform = Wscript.Arguments.Named("platform")
                      logfile.WriteLine "platform = " & platform
                    If Not CInt(platform) = CInt(domainrole) Then
                        logfile.WriteLine "System running is not the correct platform as specified"
                        WScript.Quit
                    End If
                  End If
            End If
        Else
            logfile.WriteLine "platform hardcoded command line override specified as = " & platform
            domainrole = GetDomainRole()
                If Not CInt(Platform) = CInt(domainrole) Then
                    logfile.WriteLine "System running is not the correct platform as specified"
                    WScript.Quit
                End If
        End If
End Function

Function checkEmailCMD()
On Error Resume Next
    logfile.WriteLine "Inside checkEmailCMD"
        If email = "" Then
            If WScript.Arguments.Named.Exists("email") Then
                email = True
            logfile.WriteLine ("Email command line argument specified as = " & WScript.Arguments.Named("email"))
            End If
        Else
            logfile.WriteLine ("Email hardcoded command line override specified as = " & email)
            email = True
        End If
End Function
Function checkEmail1CMD()
On Error Resume Next
    logfile.WriteLine "Inside checkEmail1CMD"
        If email1 = "" Then
            If WScript.Arguments.Named.Exists("email1") Then
                   email1 = True
            logfile.WriteLine ("Email1 command line argument specified as = " & WScript.Arguments.Named("email1"))
            End If
        Else
            logfile.WriteLine ("Additional email hardcoded command line override specified as = " & email)
                email1 = True
        End If
End Function


Function checkAdminShare()
On Error Resume Next
        logfile.WriteLine "Inside checkAdminShare"
        'Check for Admin$ - If not present then log
        Set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
        Set colItems = wmi.ExecQuery("Select * From Win32_Share",,48)
        present = "FALSE"
        For Each objShare In colItems
           If LCASE(objShare.Name) = "admin$" Then
              present = "TRUE"
           End If
        Next
        If present <> "TRUE" Then
           If Email = True Then
              logfile.writeline "Sending email that Admin$ is missing"
              Call EmailMessage("Admin$ Missing", Compname & " does not have an Admin$.")
           Else
              logfile.writeline "Admin$ is missing."
           End If 
        End If
End Function

Function checkCCMSetupRunning()
On Error Resume Next
      logfile.writeline "Inside checkCCMSetupRunning"
        'Abort if ccmsetup running
        Results = ServiceState("ccmsetup")
        If LCase(Results) = LCase("Running")Then
                    logfile.writeline "Sending email that ccmsetup service is running and script is aborting"
                    Call EmailMessage("Aborting Client Installation", "ccmsetup is running on " & CompName)
                    WScript.Quit
                
                    logfile.writeline "Exiting script processing because ccmsetup service is running"
                    WScript.Quit
                
            Elseif LCase(Results) = LCase("Stopped")Then
                logfile.WriteLine "ccmsetup service is in a stopped state, attempting to start"
                KickService("ccmsetup")
            End If
End Function

Function checkBITSrunning()
On Error Resume Next
      logfile.writeline "Inside checkBITSRunning"
        'Start BITS running
        Results = ServiceState("BITS")
        If LCase(Results) = LCase("Running")Then
                    logfile.writeline "BITS is running"

        Else
                logfile.WriteLine "BITS service is in a stopped state, attempting to start"
                KickService("BITS")
        End If
End Function

Function checkClient()
On Error Resume Next
      logfile.writeline "Inside checkClient"
        ' SMS Client COM object available, Version Installed, & WMI Namespace available
          Set SmsClient = GetObject("winmgmts:ROOT/CCM:SMS_Client=@")
          If Err Then
            'Advanced client not installed
            logfile.writeline "Advanced Client not installed, calling AdvCliInst to install the client"
            Call AdvCliInst(ComSpec)
            WScript.Sleep 1000
            Call Cleanup
            WScript.Quit
          Else
              logfile.writeline SmsClient.ClientVersion
            Select Case SmsClient.ClientVersion
'IMPORTANT! >>>>>>>>> Adjust CASE as necessary, but do *not* remove it! <<<<<<<<IMPORTANT!
          'Alter this by adding an additional CASE statement followed by the version in quotes for each SMS client
          'version which is allowed in the hierarchy. This can also be used as an additional cleanup method after
          'upgrading clients for those that might have missed this via software distribution  
          'Case "2.50.3174.1018"
          'Case "2.50.4160.2000" 'SP2 Version
          Case "4.00.6221.1000" 'configMGR sp1 client
          logfile.writeline "SMS Client Version Passed"
            WScript.Sleep 1
              Case Else
                  logfile.writeline "Calling AdvCliInst routine to install SMS Advanced client"
                Call AdvCliInst(ComSpec)
                WScript.Sleep 1000
                Call Cleanup
                WScript.Quit
            End Select
          End If
End Function

Function checkLogsUpdate()
On Error Resume Next
          Set SmsClient = GetObject("winmgmts://./root/ccm:SMS_Client")
        ' SMS Logs recently updated
           logfile.writeline "Begining to evaluate " & windir & "\system32\CCM\Logs\PolicyEvaluator.log"
          strSMSPolEval = windir & "\system32\CCM\Logs\PolicyEvaluator.log"
          startdate = ShowFileAccessInfo(strSMSPolEval, Compname)
          logfile.writeline "startdate = " & startdate
          enddate = date()
          logfile.writeline "enddate = "  & enddate
    
          If isDate(startdate) Then
            diffdate = DateDiff("d", startdate, enddate)
            logfile.writeline "diffdate = " & diffdate
          End If
    
          If diffdate > 21 Then
              If Email = True Then
                  logfile.writeline "diffdate is greater than 21 days, sending email"
                   Call EmailMessage("Log files are out of date", Compname & " has not updated is logs in 21 days or more - attempting client repair")
              End If
                  logfile.writeline "diffdate is greater than 21 days, attempting to repair SMS Client"
                  smsClient.RepairClient
                  wscript.quit
          End If
End Function

Function checkBITSversion()
On Error Resume Next
        'Check BITS version, email if out of date
        logfile.writeline "Checking BITS version by looking at " & windir & "\system32\QMgr.dll"
        If fso.FileExists(windir & "\system32\QMgr.dll") Then
                BitsVersion = fso.GetFileVersion(windir & "\system32\QMgr.dll")
                logfile.writeline "BitsVersion is " & BitsVersion
                Select Case BitsVersion 

                  ' Case for Windows 2000 Server and Pro
                  Case "6.6.2600.1596"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1
                    
                  ' Case for Windows XP SP2
                  Case "6.7.2600.3143"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1

                  ' Case for Windows XP SP3
                  Case "6.7.2600.5512"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1
                    
                   ' Case for Server 2003 SP1
                           Case "6.6.3790.1830"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1

                ' Case for Server 2003 SP2
                           Case "6.6.3790.3959"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1
                    
                  ' Case for Vista
                           Case "7.0.6000.16386"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1

                  ' Case for Server 2008 SP1
                           Case "7.0.6001.18000"
                  logfile.writeline "BitsVersion Passed"
                    WScript.Sleep 1
                   

                   ' Case for failure
                   Case Else
                       If Email = True Then
                             logfile.writeline "BITS is out of date, sending email"
                            Call EmailMessage("BITS out of date", Compname & " - BITS version is at " & BitsVersion)
                        Else
                            logfile.writeline "BITS is out of date, exiting script processing"
                            WScript.Quit
                        End If
                End Select
        Else
            If Email = True Then
                logfile.writeline "Unable to process BITS version because " & windir & "\system32\QMgr.dll is missing. Sending email."
                Call EmailMessage("File Missing", "%system32%\QMgr.dll" & " is missing on " & Compname)
            Else
                logfile.writeline "Unable to process BITS version because " & windir & "\system32\QMgr.dll is missing. Exiting Script processing."
                WScript.Quit
            End If
        End If
End Function

Function checkServices()
On Error Resume Next
        ' SMS Agent Host Service started
        logfile.writeline "Calling KickService"
        Call KickService("CcmExec")
    
        ' Remote Registry Service started
        logfile.writeline "Calling RemoteRegistry"
        Call KickService("RemoteRegistry")        
End Function

Function checkAssignment()
On Error Resume Next
        'Ensure that the client is assigned to a site if its not assigned to any
        logfile.writeline "Checking to make sure SMS Client has site assignment"
        Set ISmsClient = CreateObject ("Microsoft.SMS.Client")
        AssignedSite = ISmsClient.GetAssignedSite
        If NOT Len(AssignedSite & "")>0 Then
              logfile.writeline "Client is not assigned, attempting to AutoDiscover and set"
              ISmsClient.EnableAutoAssignment 1
            DiscoveredSite = ISmsClient.AutoDiscoverSite
            ISmsClient.SetAssignedSite DiscoveredSite,0
            logfile.writeline "Client is now assigned to " & ISmsClient.GetAssignedSite
        End If
        logfile.writeline "Client is already assigned to " & ISmsClient.GetAssignedSite
End Function




' =====================================================
' KickService function
' =====================================================
  Function KickService(servicename)
  On Error Resume Next
  logfile.writeline "Inside KickService"
  Dim Results, wmi, Service, returncode, Service2, Started
          Results = ServiceState(servicename)
          logfile.writeline "servicename = " & servicename
          logfile.writeline "Results = " & Results
          set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
          
        If NOT LCase(Results) = LCase("Running")Then
            set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
            For Each Service In Results
                ' Start service
                  returncode = Service.StartService
                  logfile.writeline "returncode = " & returncode
                  if returncode <> 0 Then
                          If Email = True Then
                              logfile.writeline "SMS Client Service Failure " & servicename & " failed to start on " & CompName
                            Call EmailMessage("Start Service Error", "SMS Client Service Failure " & servicename & " failed to start on " & CompName)
                            Call Cleanup
                            logfile.writeline "Quiting Script"
                            WScript.Quit
                        Else
                            logfile.writeline "Displaying message to user - Error starting service your Windows Management Service (" & servicename & ") - 

Call The Help Desk immediately"
                            msgbox "Error starting service your Windows Management Service (" & servicename & ") - Call The Help Desk immediately"
                            Call Cleanup
                            logfile.writeline "Quiting Script"
                            WScript.Quit
                        End If
                  end If
                  Do Until Started = True
'IMPORTANT! >>>>>>>>> Adjust sleep as necessary, but do *not* remove it! <<<<<<<<IMPORTANT!
                    logfile.writeline "Sleeping for 2 seconds..."
                    logfile.writeline "Use the below text to see how many times the script looped to start the Service"
                     WScript.Sleep 2000 'Sleep for 2 Seconds                    
                     set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
                      for each Service2 In Results
                       if lcase(Service2.State) = lcase("Running") Then
                       logfile.writeline "Started = " & Started
                           Started = True
                       end If
                      Next
                  Loop
            Next
         End If 
    End Function  
' =====================================================
' ServiceState subprocedure
' =====================================================
      Function ServiceState(servicename)
      On Error Resume Next
      logfile.writeline "Inside ServiceState"
      logfile.WriteLine "Checking " & servicename & " service"
      Dim wmi, Results, Service, StateResults, StartMode
      set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
    set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
    For Each Service In Results
        StateResults = Service.State
        logfile.writeline "StateResults = " & StateResults
    Next
      ServiceState = StateResults
    End Function
' =====================================================
' AdvCliInst subprocedure
' =====================================================
    Function AdvCliInst(ComSpec)
      On Error Resume Next
      logfile.writeline "Inside AdvCliInst"
      logfile.WriteLine "Calling Bits Check"
      objCurTime = Time()
      objCurHour = Hour(objCurTime)
      objCurMin = Minute(objCurTime)+5
      objInstallTime = objCurHour & ":" & objCurMin
      Call checkBITSrunning()
      Dim smsinstall, WshShell, InstallArgs
      Set WshShell = WScript.CreateObject("WScript.Shell")
      ComSpec = WshShell.ExpandEnvironmentStrings("%COMSPEC%")
      If ComSpec = "" Then
        If Email = True Then
            logfile.writeline "SMS Client Installation Failure", "The SMS Client failed to Install On " & CompName
            Call EmailMessage("SMS Client Installation Failure", "The SMS Client failed to Install On " & CompName)
            Call Cleanup
            logfile.writeline "Exiting Script Processing"
            WScript.Quit
        Else
            logfile.writeline "Displaying Message to user - Windows Management Service Installation Failed.  Please contact The Help Desk"
            MsgBox "Windows Management Service Installation Failed.  Please contact The Help Desk"
            Call Cleanup
            logfile.writeline "Exiting Script Processing"
            WScript.Quit
          End If          
      Else
      InstallArgs = ""
            If Wscript.Arguments.Named.Exists("params") Then
              If Wscript.Arguments.Named("params") <> "" Then
                   InstallArgs = Wscript.Arguments.Named("params")
                   logfile.writeline = "InstallArgs = " & InstallArgs
              End If
          End If
        If Exist (Wscript.Arguments.Named("smsserver") & "\SMSClient\ccmsetup.exe") Then
        'smsinstall = ComSpec & " /c \\" & Wscript.Arguments.Named("smsserver") & "\SMSClient\ccmsetup.exe" & InstallArgs 
        smsinstall = "at " & objInstallTime & " \\" & Wscript.Arguments.Named("smsserver") & "\SMSClient\ccmsetup.exe" & InstallArgs
        logfile.writeline "Calling SCCM Client installation with below command line:"
        logfile.writeline "smsinstall = " & smsinstall
      ' Run SMS Client Installation
        Call EmailMessage("SMS Install", Compname & " -Installing SCCM Client as " & smsinstall)
        WshShell.Run smsinstall,0,False
        Else
        logfile.WriteLine "Cannot Find SCCM client installer"
        Call EmailMessage("SMS Installer Missing", Compname & " -" & Wscript.Arguments.Named("smsserver") & "\SMSClient\ccmsetup.exe")
        End If
        
      End If
    End Function
' =====================================================
' GetDomainRole function
' =====================================================
    Function GetDomainRole
      On Error Resume Next
      logfile.writeline "Inside GetDomainRole"
      Dim domainroles, wmi, domainrole
      Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
      Set domainroles = wmi.ExecQuery("SELECT DomainRole FROM Win32_ComputerSystem")
      For Each domainrole in domainroles
        GetDomainRole = domainrole.DomainRole
        logfile.writeline "GetDomainRole = " & GetDomainRole
      Next
      Set domainroles = Nothing
      Set wmi = Nothing
    End Function
' =====================================================
' EmailMessage subprocedure
' =====================================================
    Function EmailMessage(Subject, Body)
      On Error Resume Next
      logfile.writeline "Inside EmailMessage"
      logfile.writeline "Email Subject: " & Subject
      logfile.writeline "Email Body: " & Body
      Dim objEmail, objemailfrom
          ' email using a generic user account as system is being booted up and user may not have logged on yet
      Set objEmail = CreateObject("CDO.Message")
      objemailfrom = WScript.Arguments.Named("smsserver") & "@company.com"
      objEmail.From = objemailfrom
      objEmail.To = WScript.Arguments.Named("email")
      objEmail.CC = WScript.Arguments.Named("email1")
'      objEmail.To = "smsadmins@company.com"
      objEmail.Subject = Subject
      objEmail.Textbody = Body
      objEmail.Configuration.Fields.Item _
      ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
      objEmail.Configuration.Fields.Item _
      ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = _
      "smtp.company.com" 
      objEmail.Configuration.Fields.Item _
      ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
      objEmail.Configuration.Fields.Update
      logfile.writeline "Sending Email"
      objEmail.Send
      Set objEmail = Nothing
    End Function
' =====================================================
' ShowFileAccessInfo function
' =====================================================
    Function ShowFileAccessInfo(filespec, Compname)
      On Error Resume Next
      logfile.writeline "Inside ShowFileAccessInfo"
      Dim fso, f, filespec_date, FSpace
      Set fso = CreateObject("Scripting.FileSystemObject")
      If fso.FileExists(filespec) Then
          Set f = fso.GetFile(filespec)
          logfile.writeline "f = " & f
          filespec_date = f.DateLastModified
          logfile.writeline "filespec_date = " & filespec_date
          FSpace = Instr(filespec_date," ") - 1
          logfile.writeline "FSpace = " & FSpace
          ShowFileAccessInfo = Left(filespec_date,FSpace)
          logfile.writeline "ShowFileAccessInfo = " & ShowFileAccessInfo
      Else
          If Email = True Then
              logfile.writeline "File Missing - " & filespec & " is missing On " & Compname
              Call EmailMessage("File Missing", filespec & " is missing On " & Compname)
              logfile.writeline "Exiting Script Processing"
              WScript.Quit
          End If
      End If
    End Function
' =====================================================
' Destroy any objects
' =====================================================  
    Sub Cleanup
      On Error Resume Next
      logfile.writeline "Inside Cleanup"
      Set WshShell = Nothing
      Set ComSpec = Nothing
      Set windir = Nothing
      Set strCompName = Nothing
      Set SmsClient = Nothing
    End Sub
  ' =====================================================

Interactive Services Detection Service

2008-11-07T08:00:00.000-08:00

Yesterday another admin notified me that his Vista machine prompted him before showing a message from a program I had distributed via SCCM. The name of the prompt was "Interactive Services Dialog Detection", and it was requesting to show him a message.

Selecting "Show me the message" hides the desktop and allows the user to see the message. After viewing the message, the user had to click on "Return Now" to get back to the desktop.

This event was a surprise to me. I've been running Vista since it came out and the program we advertised has been advertised for the last 3 years, and we run it every month. After researching this service, I discovered that it is a new security feature in Vista. Designed to protect users by intercepting messages run under another security context. In this case, the program is advertised to run whether or not a user is logged on, but allow users to interact with the program. When these options are chosen in SCCM, the program runs under the machine account as a service. Since this program pops up a message, we chose the option to allow users to interact so they can see the message and click okay on it. Vista may see this as a security risk if the Interactive Services Detection service is running. We checked 4 different Vista machines, and it appears the default behavior is the service is Stopped and set to Manual. UAC did not appear to have any affect on this service. Apparently this admin had done something else to set this service to Running. There are several available ways to resolve this issue:

Choose the option to run the program only when a user is logged on, and run it as the user.
Don't make the program interactive (user will not see the program).
Stop the Interactive Services Detection service.

Ignore it. Vista is doing it's job of being safer. Users may have to click an extra prompt.

I don't really recommend stopping or disabling the service since that is a built in security feature of Vista. But it will prevent the prompt from appearing if desired.

Organize Collections with Drag and Drop

2008-11-05T06:21:00.001-08:00

One of the plans we've had since I took over the administration of Configuration Manager is to organize the objects in the admin console. SCCM makes it easier than SMS since it supports drag and drop. The catch is that it only supports it with certain types of objects. Collections is one of the object types that doesn't support drag and drop. The only way I found to reorganize collection objects was to make a link of a collection to a second collection. Making this link actually makes a 2nd instance of the collection appear in the hierarchy. Then you can go back and safely delete the original collection. The other option is to use a Microsoft provided SMS tool called CollTree. Yes, the program does work with SCCM. After downloading the SMS 2003 SDK you can compile the executable from \Program Files\Microsoft Systems Management Server 2003 SDK V3\Samples\VB\CollTree\CollTree.vbp It's not as great as if Microsoft had built this functionality into the Admin Console, but at least it works! Download a compiled version of CollTree here: http://myitforum.com/cs2/blogs/bleary/attachment/68439.ashx

Credits to Brian Leary for pointing out this useful tool: http://myitforum.com/cs2/blogs/bleary/archive/2006/12/01/colltree-drag-and-drop-collections-for-sms-2003.aspx

Upgrade BITS

2008-10-23T07:22:00.001-07:00

As companies move from SMS 2003 to SCCM one of the items frequently mentioned is the desire to predeploy the latest version of BITS (Background Intelligent Transfer Service). This makes it possible to deploy the client without requiring a reboot. However, Microsoft didn't really provide a method for doing the BITS deployment. So I wrote my own. Download the latest versions of BITS from: 2000, XP, 2003, x64- XP and 2003

They will need to be in a subdirectory named bin of this script. The script will require a drive letter to run, so when you create the program be sure to specify that option. The nice thing about this script is that you can deploy to everybody, and it will only upgrade those that need it.

'==========================================================================
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.0
'
' NAME: Install_Bits.vbs
' AUTHOR: Bill Phillips , ESRI
' DATE  : 10/22/2008
'
' COMMENT: 
'==========================================================================
On Error Resume Next
Dim strOSName, strSPName,  strComputerType, systemroot, detectfile
Dim objFile, strFileVersion, strInstallFile


Set objShell = CreateObject ("Wscript.Shell")
set objEnv = objShell.Environment("Process")
systemroot = objEnv("SYSTEMROOT")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objExp = new regexp  'Create the RegExp object


detectOS()
detectFileversion(systemroot & "\system32\QMgr.dll")
compareBITSVersion(strFileVersion)
installBITS()

' ********************************************************************************
'Detect OS Function
'********************************************************************************
Function detectOS()
For Each objOS In GetObject("winmgmts:").InstancesOf ("Win32_OperatingSystem")
    strOSName = objOS.Caption
    strSPName = "SP" & objOS.ServicePackMajorVersion
Next

For Each objComputer In GetObject("winmgmts:").InstancesOf ("Win32_ComputerSystem")
 strComputerType = objComputer.systemtype
Next

'need to normalize data (too many different versions of windows)
    objExp.Pattern = "2000"
    If objEXP.Test (strOSName) Then
        strOSName = "win2k"
    End If

    objExp.Pattern = "XP"
    If objEXP.Test (strOSName) Then
        strOSName = "winXP"
    End If

    objExp.Pattern = "2003"
    If objEXP.Test (strOSName) Then
        strOSName = "w2k3"
    End If

    objExp.Pattern = "Vista"
    If objEXP.Test (strOSName) Then
        strOSName = "Vista"
    End If

    objExp.Pattern = "2008"
    If objEXP.Test (strOSName) Then
         strOSName = "w2k8"
     End If
End Function

Function detectFileversion(detectfile)
If objFSO.FileExists(detectfile) Then
Set objFile = objFSO.GetFile(detectfile)
strFileVersion = objFSO.GetFileVersion(detectfile)
End If

End Function

Function compareBITSVersion(strFileVersion)
    Select Case strFileVersion
        ' Case for Windows 2000 Server and Pro
        Case "6.6.2600.1596"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Windows XP SP2
        'Case "6.7.2600.3143"
        Case "Fake"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Windows XP SP3
        Case "6.7.2600.5512"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Server 2003 SP1
        Case "6.6.3790.1830"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Server 2003 SP2
        Case "6.6.3790.3959"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Vista RTM
        Case "7.0.6000.16386"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1
        
        ' Case for Vista and Server 2008 SP1 x32 & x64
        'Case "7.0.6001.18000"
        Case "fake"
        'wscript.echo "BitsVersion Passed"
        WScript.quit
        WScript.Sleep 1        
        ' Case for failure
        Case Else
        'WScript.Echo "Bits Failed"
        selectBITSinstall()
    End Select
End Function

Function selectBITSinstall()
    Select Case strComputerType
        Case "x64-based PC"
            Select Case strOSName
                Case "w2k3"
                strInstallFile = "WindowsServer2003.WindowsXP-KB923845-x64-ENU.exe"
                Case "winXP"
                strInstallFile = "WindowsServer2003.WindowsXP-KB923845-x64-ENU.exe"
            End Select
        Case "X86-based PC"
             Select Case strOSName
                 Case "win2k"
                 strInstallFile = "Windows2000-KB842773-x86-ENU.exe"
                 Case "winXP"
                 strInstallFile = "WindowsXP-KB923845-x86-ENU.exe"
                 Case "w2k3"
                 strInstallFile = "WindowsServer2003-KB923845-x86-ENU.exe"
             End Select
    End Select

' no match found so quitting
If strInstallFile = "" Then
WScript.Quit
End If

End Function

Function installBITS()
'Turn off prompt for unknown locations
objEnv("SEE_MASK_NOZONECHECKS") = 1


objShell.Run ("bin\" & strInstallFile & " /passive /norestart /overwriteoem")', 1, True

'Turn prompt back On
objEnv.Remove("SEE_MASK_NOZONECHECKS")
End Function

Client Health Check Script

2008-10-22T08:01:00.001-07:00

See updated post: http://smsimpossible.blogspot.com/2008/12/client-health-check-script-take-2.html

1e used to have a client health check script for sms 2003. The script would reinstall the client or force a repair depending on what part of the check it failed. Since the release of SCCM they have not updated the script. I believe the old script will probably still work just by changing the install directory, but I have a rewritten version of the script that we use so I'm providing it below. I don't think there is anything wrong with posting this, but I will remove it if 1e asks me to do so. To use the script you must specify the siteserver. Also the sccm/client directory must be shared out and the script will need to be modified to reflect the share directory. After meeting these 2 requirements the script is usable. You may also specify an smtp email server in the email section and who the email should be sent to. The siteserver and email recipient may be passed as arguments or hard coded into the script.

'==========================================================================
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.0
' NAME: SCCM_Client_Health_Check.vbs
' AUTHOR: Bill Phillips , ESRI
' DATE  : 10/20/2008
'
' COMMENT: Code rewrite for SCCM client taken from 1E ClientHealth Script for SMS client
'==========================================================================
On Error Resume Next

       Dim smsserver, platform, email
       Dim domainrole, ComSpec, diffdate, enddate, fso, filedate, SmsClient, returncode, Results
       Dim ISmsClient, DiscoveredSite, AssignedSite
       Dim servicename, startdate, strMessage, strSMSPolEval, windir, wmi, colItems, wShShell, Compname, present, objShare
       Dim BitsVersion, tempdir, logfile, logsize
          
       Set WshShell = WScript.CreateObject("WScript.Shell")
       WinDir = WshShell.ExpandEnvironmentStrings("%windir%")
       Compname = WshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")
       ComSpec = WshShell.ExpandEnvironmentStrings("%COMSPEC%")
       tempdir = WshShell.ExpandEnvironmentStrings("%temp%")
      
       'Set up the loggong
       Set fso = CreateObject("Scripting.FileSystemObject")
       Set logfile = fso.OpenTextFile(tempdir & "\SCCM_Client_Health_Check.Log",2,True)
      
  
      logfile.writeline "####################################"
      logfile.writeline "Begining SCCM Client Health Check Script"
      logfile.writeline "####################################"

'Either uncomment variables below or pass arguments to script:
'sccm_client_health_check.vbs /smsserver:smststserver /email:recepient@company.com
'********************************************************HARD CODED COMMAND LINE OVERRIDES********************************************************    
'***********************************************************UNCOMMENT ONLY IF NECESSARY***********************************************************
'smsserver = "smststserver" 'Should reflect the PMP/PDP for each office
'platform = "" 'No need to modify
'Email = "recepient@company.com" 'Should be set to go to an alias that includes the needed peoeple.
'********************************************************HARD CODED COMMAND LINE OVERRIDES********************************************************    
'***********************************************************UNCOMMENT ONLY IF NECESSARY***********************************************************
checkSCCMserverCMD()
checkPlatformCMD()
checkEmailCMD()
checkAdminShare()
checkCCMSetupRunning()
checkClient()
checkLogsUpdate()
checkBITSversion()
checkServices()
checkAssignment()
   logfile.writeline "Cleaning Up"
Call Cleanup
   logfile.writeline "Ending Processing"
WScript.Quit


'Check to see if SCCM server is specifed as an argument or hardcoded into script
Function checkSCCMserverCMD()
       If smsserver = "" Then          
           If Wscript.Arguments.Named.Exists("smsserver") Then
             If Wscript.Arguments.Named("smsserver") <> "" Then
               logfile.writeline "smsserver specified in command line is " & WScript.Arguments.Named("smsserver")
             Else
               logfile.writeline "/smsserver parameter is the incorrect format. Please see documentation"
                 WScript.Quit
             End If
           Else
                logfile.writeline "Missing /smsserver: in command line"
                 WScript.Quit
           End If
       Else
           logfile.WriteLine "The SCCMserver hardcoded command line override specified as = " & smsserver
       End If
End Function

Function checkPlatformCMD()
       If platform = "" Then
             domainrole = GetDomainRole()
           If Wscript.Arguments.Named.Exists("platform") Then
                 If Wscript.Arguments.Named("platform") <> "" Then
                     platform = Wscript.Arguments.Named("platform")
                     logfile.WriteLine "platform = " & platform
                   If Not CInt(platform) = CInt(domainrole) Then
                       logfile.WriteLine "System running is not the correct platform as specified"
                       WScript.Quit
                   End If
                 End If
           End If
       Else
           logfile.WriteLine "platform hardcoded command line override specified as = " & platform
           domainrole = GetDomainRole()
               If Not CInt(Platform) = CInt(domainrole) Then
                   logfile.WriteLine "System running is not the correct platform as specified"
                   WScript.Quit
               End If
       End If
End Function

Function checkEmailCMD()
       If email = "" Then
           If WScript.Arguments.Named.Exists("email") Then
               email = True
           End If
       Else
           logfile.WriteLine ("Email hardcoded command line override specified as = " & email)
           'email = True  'uncomment if you use hardcoded email in script
       End If
End Function

Function checkAdminShare()
       'Check for Admin$ - If not present then log
       Set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
       Set colItems = wmi.ExecQuery("Select * From Win32_Share",,48)
       present = "FALSE"
       For Each objShare In colItems
          If LCASE(objShare.Name) = "admin$" Then
             present = "TRUE"
          End If
       Next
       If present <> "TRUE" Then
          If Email = True Then
             logfile.writeline "Sending email that Admin$ is missing"
             Call EmailMessage("Admin$ Missing", Compname & " does not have an Admin$.")
          Else
             logfile.writeline "Admin$ is missing."
          End If
       End If
End Function

Function checkCCMSetupRunning()
       'Abort if ccmsetup running
       Results = ServiceState("ccmsetup")
       If LCase(Results) = LCase("Running")Then
                   logfile.writeline "Sending email that ccmsetup service is running and script is aborting"
                   Call EmailMessage("Aborting Client Installation", "ccmsetup is running on " & CompName)
                   WScript.Quit
              
                   logfile.writeline "Exiting script processing because ccmsetup service is running"
                   WScript.Quit
              
           Elseif LCase(Results) = LCase("Stopped")Then
               logfile.WriteLine "ccmsetup service is in a stopped state, attempting to start"
               KickService("ccmsetup")
           End If
End Function

Function checkClient()
       ' SMS Client COM object available, Version Installed, & WMI Namespace available
         Set SmsClient = GetObject("winmgmts:ROOT/CCM:SMS_Client=@")
         If Err Then
           'Advanced client not installed
           logfile.writeline "Advanced Client not installed, calling AdvCliInst to install the client"
           Call AdvCliInst(ComSpec)
           WScript.Sleep 10000
           Call Cleanup
           WScript.Quit
         Else
             logfile.writeline SmsClient.ClientVersion
           Select Case SmsClient.ClientVersion
'IMPORTANT! >>>>>>>>> Adjust CASE as necessary, but do *not* remove it! <<<<<<<<IMPORTANT!
         'Alter this by adding an additional CASE statement followed by the version in quotes for each SMS client
         'version which is allowed in the hierarchy. This can also be used as an additional cleanup method after
         'upgrading clients for those that might have missed this via software distribution  
         'Case "2.50.3174.1018"
         'Case "2.50.4160.2000" 'SP2 Version
         Case "4.00.6221.1000" 'configMGR sp1 client
         logfile.writeline "SMS Client Version Passed"
           WScript.Sleep 1
             Case Else
                 logfile.writeline "Calling AdvCliInst routine to install SMS Advanced client"
               Call AdvCliInst(ComSpec)
               WScript.Sleep 10000
               Call Cleanup
               WScript.Quit
           End Select
         End If
End Function

Function checkLogsUpdate()
         Set SmsClient = GetObject("winmgmts://./root/ccm:SMS_Client")
       ' SMS Logs recently updated
          logfile.writeline "Begining to evaluate " & windir & "\system32\CCM\Logs\PolicyEvaluator.log"
         strSMSPolEval = windir & "\system32\CCM\Logs\PolicyEvaluator.log"
         startdate = ShowFileAccessInfo(strSMSPolEval, Compname)
         logfile.writeline "startdate = " & startdate
         enddate = date()
         logfile.writeline "enddate = "  & enddate
  
         If isDate(startdate) Then
           diffdate = DateDiff("d", startdate, enddate)
           logfile.writeline "diffdate = " & diffdate
         End If
  
         If diffdate > 21 Then
             If Email = True Then
                 logfile.writeline "diffdate is greater than 21 days, sending email"
                  Call EmailMessage(CompName & " is out of date", Compname & " has not updated is logs in 21 days or more - attempting client repair")
             End If
                 logfile.writeline "diffdate is greater than 21 days, attempting to repair SMS Client"
                 smsClient.RepairClient
                 wscript.quit
         End If
End Function

Function checkBITSversion()
      
       'Check BITS version, email if out of date
       logfile.writeline "Checking BITS version by looking at " & windir & "\system32\QMgr.dll"
       If fso.FileExists(windir & "\system32\QMgr.dll") Then
               BitsVersion = fso.GetFileVersion(windir & "\system32\QMgr.dll")
               logfile.writeline "BitsVersion is " & BitsVersion
               Select Case BitsVersion

                 ' Case for Windows 2000 Server and Pro
                 Case "6.6.2600.1596"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1
                  
                 ' Case for Windows XP SP2
                 Case "6.7.2600.3143"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1

                 ' Case for Windows XP SP3
                 Case "6.7.2600.5512"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1
                  
                      ' Case for Server 2003 SP1
                          Case "6.6.3790.1830"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1

               ' Case for Server 2003 SP2
                          Case "6.6.3790.3959"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1
                  
                 ' Case for Vista
                          Case "7.0.6000.16386"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1

                 ' Case for Server 2008 SP1
                          Case "7.0.6001.18000"
                 logfile.writeline "BitsVersion Passed"
                   WScript.Sleep 1
                 

                  ' Case for failure
                  Case Else
                      If Email = True Then
                            logfile.writeline "BITS is out of date, sending email"
                           Call EmailMessage("BITS out of date", Compname & " - BITS version is at " & BitsVersion)
                       Else
                           logfile.writeline "BITS is out of date, exiting script processing"
                           WScript.Quit
                       End If
               End Select
       Else
           If Email = True Then
               logfile.writeline "Unable to process BITS version because " & windir & "\system32\QMgr.dll is missing. Sending email."
               Call EmailMessage("File Missing", "%system32%\QMgr.dll" & " is missing on " & Compname)
           Else
               logfile.writeline "Unable to process BITS version because " & windir & "\system32\QMgr.dll is missing. Exiting Script processing."
               WScript.Quit
           End If
       End If
End Function

Function checkServices()
      
       ' SMS Agent Host Service started
       logfile.writeline "Calling KickService"
       Call KickService("CcmExec")
  
       ' Remote Registry Service started
       logfile.writeline "Calling RemoteRegistry"
       Call KickService("RemoteRegistry")       
End Function

Function checkAssignment()
       'Ensure that the client is assigned to a site if its not assigned to any
       logfile.writeline "Checking to make sure SMS Client has site assignment"
       Set ISmsClient = CreateObject ("Microsoft.SMS.Client")
       AssignedSite = ISmsClient.GetAssignedSite
       If NOT Len(AssignedSite & "")>0 Then
             logfile.writeline "Client is not assigned, attempting to AutoDiscover and set"
             ISmsClient.EnableAutoAssignment 1
           DiscoveredSite = ISmsClient.AutoDiscoverSite
           ISmsClient.SetAssignedSite DiscoveredSite,0
           logfile.writeline "Client is now assigned to " & ISmsClient.GetAssignedSite
       End If
       logfile.writeline "Client is now assigned to " & ISmsClient.GetAssignedSite
End Function




' =====================================================
' KickService function
' =====================================================
 Function KickService(servicename)
 On Error Resume Next
 logfile.writeline "Inside KickService"
 Dim Results, wmi, Service, returncode, Service2, Started
         Results = ServiceState(servicename)
         logfile.writeline "servicename = " & servicename
         logfile.writeline "Results = " & Results
         set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
        
       If NOT LCase(Results) = LCase("Running")Then
           set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
           For Each Service In Results
               ' Start service
                 returncode = Service.StartService
                 logfile.writeline "returncode = " & returncode
                 if returncode <> 0 Then
                         If Email = True Then
                             logfile.writeline "SMS Client Service Failure " & servicename & " failed to start on " & CompName
                           Call EmailMessage("Start Service Error", "SMS Client Service Failure " & servicename & " failed to start on " & CompName)
                           Call Cleanup
                           logfile.writeline "Quiting Script"
                           WScript.Quit
                       Else
                           logfile.writeline "Displaying message to user - Error starting service your Windows Management Service (" & servicename & ") - Call The Help Desk immediately"
                           msgbox "Error starting service your Windows Management Service (" & servicename & ") - Call The Help Desk immediately"
                           Call Cleanup
                           logfile.writeline "Quiting Script"
                           WScript.Quit
                       End If
                 end If
                 Do Until Started = True
'IMPORTANT! >>>>>>>>> Adjust sleep as necessary, but do *not* remove it! <<<<<<<<IMPORTANT!
                   logfile.writeline "Sleeping for 2 seconds..."
                   logfile.writeline "Use the below text to see how many times the script looped to start the Service"
                    WScript.Sleep 2000 'Sleep for 2 Seconds                    
                    set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
                     for each Service2 In Results
                      if lcase(Service2.State) = lcase("Running") Then
                      logfile.writeline "Started = " & Started
                          Started = True
                      end If
                     Next
                 Loop
           Next
        End If
   End Function 
' =====================================================
' ServiceState subprocedure
' =====================================================
     Function ServiceState(servicename)
     On Error Resume Next
     logfile.writeline "Inside ServiceState"
     logfile.WriteLine "Checking " & servicename & " service"
     Dim wmi, Results, Service, StateResults, StartMode
     set wmi = getobject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
   set Results = wmi.execquery("select state from win32_service where name='" & servicename & "'")
   For Each Service In Results
       StateResults = Service.State
       logfile.writeline "StateResults = " & StateResults
   Next
     ServiceState = StateResults
   End Function
' =====================================================
' AdvCliInst subprocedure
' =====================================================
   Sub AdvCliInst(ComSpec)
     On Error Resume Next
     logfile.writeline "Inside AdvCliInst"
     Dim smsinstall, WshShell, InstallArgs

     Set WshShell = WScript.CreateObject("WScript.Shell")
     ComSpec = WshShell.ExpandEnvironmentStrings("%COMSPEC%")
     If ComSpec = "" Then
       If Email = True Then
           logfile.writeline "SMS Client Installation Failure", "The SMS Client failed to Install On " & CompName
           Call EmailMessage("SMS Client Installation Failure", "The SMS Client failed to Install On " & CompName)
           Call Cleanup
           logfile.writeline "Exiting Script Processing"
           WScript.Quit
       Else
           logfile.writeline "Displaying Message to user - Windows Management Service Installation Failed.  Please contact The Help Desk"
           MsgBox "Windows Management Service Installation Failed.  Please contact The Help Desk"
           Call Cleanup
           logfile.writeline "Exiting Script Processing"
           WScript.Quit
         End If         
     Else
     InstallArgs = ""
           If Wscript.Arguments.Named.Exists("params") Then
             If Wscript.Arguments.Named("params") <> "" Then
                  InstallArgs = Wscript.Arguments.Named("params")
                  logfile.writeline = "InstallArgs = " & InstallArgs
             End If
         End If
       smsinstall = ComSpec & " /c \\" & Wscript.Arguments.Named("smsserver") & "\SMSClient\ccmsetup.exe SMSSLP=smststserver Disablesiteopt=true FSP=smststserver SMSSITECODE=tst" & InstallArgs
       logfile.writeline "Calling SCCM Client installation with below command line:"
       logfile.writeline "smsinstall = " & smsinstall
     ' Run SMS Client Installation
       WshShell.Run smsinstall,0,False
     End If
   End Sub
' =====================================================
' GetDomainRole function
' =====================================================
   Function GetDomainRole
     On Error Resume Next
     logfile.writeline "Inside GetDomainRole"
     Dim domainroles, wmi, domainrole
     Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
     Set domainroles = wmi.ExecQuery("SELECT DomainRole FROM Win32_ComputerSystem")
     For Each domainrole in domainroles
       GetDomainRole = domainrole.DomainRole
       logfile.writeline "GetDomainRole = " & GetDomainRole
     Next
     Set domainroles = Nothing
     Set wmi = Nothing
   End Function
' =====================================================
' EmailMessage subprocedure
' =====================================================
   Function EmailMessage(Subject, Body)
     On Error Resume Next
     logfile.writeline "Inside EmailMessage"
     logfile.writeline "Email Subject: " & Subject
     logfile.writeline "Email Body: " & Body
     Dim objEmail, objemailfrom
         ' email using a generic user account as system is being booted up and user may not have logged on yet
     Set objEmail = CreateObject("CDO.Message")
     objemailfrom = WScript.Arguments.Named("smsserver") & "@company.com"
     objEmail.From = objemailfrom
     objEmail.To = WScript.Arguments.Named("email")
'      objEmail.To = "receipants@company.com"
     objEmail.Subject = Subject
     objEmail.Textbody = Body
     objEmail.Configuration.Fields.Item _
     ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
     objEmail.Configuration.Fields.Item _
     ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = _
     "smtp.company.com"
     objEmail.Configuration.Fields.Item _
     ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
     objEmail.Configuration.Fields.Update
     logfile.writeline "Sending Email"
     objEmail.Send
     Set objEmail = Nothing
   End Function
' =====================================================
' ShowFileAccessInfo function
' =====================================================
   Function ShowFileAccessInfo(filespec, Compname)
     On Error Resume Next
     logfile.writeline "Inside ShowFileAccessInfo"
     Dim fso, f, filespec_date, FSpace
     Set fso = CreateObject("Scripting.FileSystemObject")
     If fso.FileExists(filespec) Then
         Set f = fso.GetFile(filespec)
         logfile.writeline "f = " & f
         filespec_date = f.DateLastModified
         logfile.writeline "filespec_date = " & filespec_date
         FSpace = Instr(filespec_date," ") - 1
         logfile.writeline "FSpace = " & FSpace
         ShowFileAccessInfo = Left(filespec_date,FSpace)
         logfile.writeline "ShowFileAccessInfo = " & ShowFileAccessInfo
     Else
         If Email = True Then
             logfile.writeline "File Missing - " & filespec & " is missing On " & Compname
             Call EmailMessage("File Missing", filespec & " is missing On " & Compname)
             logfile.writeline "Exiting Script Processing"
             WScript.Quit
         End If
     End If
   End Function
' =====================================================
' Destroy any objects
' =====================================================  
   Sub Cleanup
     On Error Resume Next
     logfile.writeline "Inside Cleanup"
     Set WshShell = Nothing
     Set ComSpec = Nothing
     Set windir = Nothing
     Set strCompName = Nothing
     Set SmsClient = Nothing
   End Sub
 ' =====================================================

open file - security warning

2008-10-16T16:56:00.000-07:00

In our SCCM environment we frequently use the option to run from server instead of download and run. One of the issues we've seen from time to time is if our script calls another program that was downloaded from the internet it may have had the untrusted source bit set during the download. In our scripts we get around the Open File - Security warning dialog box by temporarily turning off zone checking. At the end of the script we turn zone checking back on. No need to add servers to trusted sites via group policy! More info on this problem here:

http://blogs.msdn.com/gblock/archive/2006/12/19/tips-steams-zones-vista-and-blocked-files-in-ie.aspx?CommentPosted=true#commentmessage

set objShell = CreateObject("Wscript.shell")

Set objEnv = objShell.Environment("PROCESS")

' ********************************************************************************

'Main Routine

'*********************************************************************************

objEnv("SEE_MASK_NOZONECHECKS") = 1

objShell.Run("taskkill.exe /F /IM foo.exe"),,False

Install_Application()

objEnv.Remove("SEE_MASK_NOZONECHECKS")

WSCRIPT.QUIT

' ********************************************************************************

'Install Application

'*********************************************************************************

Function Install_Application()

'setup program

objShell.run("fooInstall.exe /silent"),1,true

Wscript.Sleep(5000)

End Function

configmgr right click tools

2008-10-09T07:49:00.000-07:00

If your familiar with the sms 2003 right click tools, then your probably already know that there are new console extenstions available for SCCM. My favorite is Rick Houchin's SCCM Right Click tools: http://myitforum.com/cs2/blogs/rhouchins/archive/2008/04/09/sccm-right-click-tools.aspx Download version 1.7 directly from: http://myitforum.com/cs2/blogs/rhouchins/0613ConfigMgrTools.zip For those of you who haven't tried them, I highly recommend that you do since they make life so much easier.

Update Package versus Refresh Package

2008-10-08T08:00:00.000-07:00

You may have noticed that if you right click on the distribution point node of a Package you will get an option to Update Distribution points. If you open the node and right click on an individual DP you will get an option to refresh the package on that distribution point. There is no option to refresh a package on all DP's and there is no option to Update a package on just one DP. What's going on here? Well, each function is slightly different. When you create a package and assign a source location to it, that package is actually stored on the site server in the SMSPKG folder as a compressed file in the form of PackageID.pck extension. This folder is shared out from the site server as \\server\SMS_CPSx$, where x represents the drive letter it is located on. When choosing the option to Update a package a delta file of the changes is created from the specified source location and the version number is incremented for both the source and client policy. The delta file is what gets sent out to the DP's. Choosing the option to refresh a package will actually repair a package at a DP by recopying the entire compressed package from the local site server to the DP. There is no update of any changes that may have occured at the package source.

More info: http://technet.microsoft.com/en-us/library/bb892806.aspx
and here: http://www.serverwatch.com/tutorials/article.php/1474011

Script to Force Client Inventory on 64-Bit OS

2008-10-06T08:00:00.000-07:00

In my previous post I posted the script to force HW and SW inventory on a client. However if you run the script on 64-bit vista or '08, you will get a 800a01ad error code (I'm guessing this will also happen of 64-bit XP, but didnt' test it). The specific error is: ActiveX component can't create object: 'CPAPPLET.CPAppletMgr' . The issue is that configmgr's applet's are 32-bit only. On a 64-bit system, Open control panel and you will not see the configmgr cpl, unless you open the "View 32-bit Control Panel" applet. By default, 64-bit versions of windows call the 64-bit version of the scripting host (wscript or cscript), which will only talk to the 64-bit part of the control panel. So the solution is to call the 32-bit scripting host that will talk to the 32-bit control panel items. A simple batch file to run from either verison of the OS to launch your vbs using the correct scripting host will do the trick:

if exist %systemroot%\SysWOW64\cscript.exe goto run64
\\server\share\swinventory.vbs
exit
:run64
%systemroot%\SysWOW64\cscript.exe \\server\share\swinventory.vbs
exit

Script to Force Hardware or Software Inventory

2008-10-03T06:27:00.000-07:00

In my previous post I stated that we were allowing users to opt in to a collection on their own by putting a dummy exe on their computers. The collection is setup to update its membership nightly. However, clients need to run software inventory to report the new exe back to the Management Point. Here's a VB script that clients can run to kick this process off. Credit to Chris Stauffer at myitforum for the original code ( http://myitforum.com/cs2/blogs/cstauffer/archive/2007/04/04/script-to-perform-a-full-sms-inventory.aspx). Also, I added in the Hardware Inventory version in case your adding registry keys, wmi classes, other HWinv type items. If you want to verify that it's running check the inventoryagent.log file on the client.

On Error Resume Next

ForceSoftwareInventory()

ForceHardwareInventory()

'*********************************************************************************************************

'Force Software Inventory on the Client

'*********************************************************************************************************

Function ForceSoftwareInventory()

Set sho = CreateObject("WScript.Shell")

strSystemRoot = sho.expandenvironmentstrings("%SystemRoot%")

strCurrentDir = Left(Wscript.ScriptFullName, (InstrRev(Wscript.ScriptFullName, "\") -1))

'Run a SMS Software Inventory

Set cpApplet = CreateObject("CPAPPLET.CPAppletMgr")

Set actions = cpApplet.GetClientActions

For Each action In actions

If Instr(action.Name,"Software Inventory Collection Cycle") > 0 Then

action.PerformAction

' WScript.Echo action.name

End If

End Function

'*********************************************************************************************************

'Force Hardware Inventory on the Client

'*********************************************************************************************************

Function ForceHardwareInventory()

Set sho = CreateObject("WScript.Shell")

strSystemRoot = sho.expandenvironmentstrings("%SystemRoot%")

strCurrentDir = Left(Wscript.ScriptFullName, (InstrRev(Wscript.ScriptFullName, "\") -1))

'Run a SMS Hardware Inventory

Set cpApplet = CreateObject("CPAPPLET.CPAppletMgr")

Set actions = cpApplet.GetClientActions

For Each action In actions

If Instr(action.Name,"Hardware Inventory Collection Cycle") > 0 Then

action.PerformAction

' WScript.Echo action.name

End If

End Function

query collection based on file existing on machine

2008-09-30T06:54:00.000-07:00

At my company we wanted to create a system where developers could opt in to receive a copy of the nightly build of the software they were working on. In the first part of this project we create a collection based on the software inventory of a particular file. By default SCCM looks for any *.exe's on client systems. Rather than add another file type, we created a dummy exe as the criteria for our collection:

Criterion Type: Simple Value

Where: Software Files – File Name

Operator: is equal to

Value: Filename.exe

Equilivent in wql:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FileName = "Filename.exe"

SCCM MindMap

2008-09-28T12:10:00.001-07:00

I've been very busy this past week updating or SCCM environment to SP1. We want to be at SP1 before we start updating clients from SMS 2003. During the process I've been helping another admin learn some of the in's and out's of SCCM. To help I put together a quick mindmap that will help people new to SCCM wrap their heads around it. You can create your own mindmap at http://www.text2mindmap.com/ .

If you like my list and want to add to it:

SCCM

Software Distribution

Packages

Source

Refresh Distribution Point

Programs

Advertisments

Available

Mandatory

Expires

Collections

Static

Dynamic

Software Updates

Updates lists

Deployment Templates

Deployment Management

Deployment Packages

OSD

Tasks

Drivers

Clients Do Not Run Mandatory Advertisements and They Return Status Message 10052

2008-09-19T07:34:00.000-07:00

Yesterday I created a program for a package and advertised it to some test machines. The package was pretty small so I decided to use the download and run option instead of my normal run from Distribution Point. Everything else I did the same way I normally do. To my surprise the program refused to run on the clients. Checking the Advertisment Status logs I found the error being returned by the clients: 10052 The program for the advertisement "advertisementID" ("packageID" - "program_name") could not be run because the policy contains an invalid combination of requirements: site_code. Possible causes: The program is set to run when no user is logged on, but is being advertised to a user. The program is set to require user input, but does not require that a user be logged on in order to run. Solution: Examine the properties of the program to resolve the conflicting requirements. I found out that setting the client to download and run, and requires a mapped drive letter will trigger this error message. No need to map a drive letter if the content is already on the machine! Anyway here is Microsofts KB on the same issue (written for SMS 2003): http://support.microsoft.com/kb/829858

Script to Modify SCCM Advertisement

2008-09-17T18:55:00.000-07:00

Below is a script I wrote to echo out all the proprieties from an SCCM advertisement. Then I modified the comment property and saved it back. You can modify any property you want, but the Mandatory Assignments will be tricker since they are in an Array.

' --- Set Variables
siteName = "tst"
serverName = "SMSSITESERVER"
SMS_AdvertisementID = "tst20408"
Dim replacementScheduleArray()
Dim SMS_ScheduleToken

' --- Create Objects
Set loc = CreateObject("WbemScripting.SWbemLocator")
Set WbemServices = loc.ConnectServer(servername , "root\SMS\site_" & siteName)

smsAdvertisement()

' --- Refresh Package
Function smsAdvertisement()
Set colAdvertisements = WbemServices.ExecQuery("Select * From SMS_Advertisement where AdvertisementID='" & SMS_AdvertisementID & "'")
Set objAdvertisement = WbemServices.Get("SMS_Advertisement.AdvertisementID='" & SMS_AdvertisementID & "'")
Set Advertisement_Properties = objAdvertisement.Properties_ 'get property Set
set AssignedScheduleArray = Advertisement_Properties.Item("AssignedSchedule")

For each Advertisement In colAdvertisements
'Get Info
Wscript.Echo "adname " & Advertisement.AdvertisementName
wscript.echo "ad ID " & Advertisement.AdvertisementID
wscript.echo "ad Flag " & Advertisement.AdvertFlags
wscript.echo "Present Time " & Advertisement.PresentTime
wscript.echo "Present Time enforced? " & Advertisement.PresentTimeEnabled
wscript.echo "TimeFlags Property " & Advertisement.TimeFlags
wscript.echo "Is Assigned Schedule Enabled/active? Must be true for Mandatory True/false " & Advertisement.AssignedScheduleEnabled
wscript.echo "Expiration Time " & Advertisement.ExpirationTime
wscript.echo "Expiration Time Enabled? " & Advertisement.ExpirationTimeEnabled
wscript.echo "Collection ID " & Advertisement.collectionID
wscript.echo "Package ID " & Advertisement.PackageID
wscript.echo "Program Name " & Advertisement.ProgramName

For i = 0 to UBound(AssignedScheduleArray)
Set SMS_ScheduleToken = AssignedScheduleArray(i)
WScript.Echo AssignedScheduleArray.Name & " " & i & ":" & SMS_ScheduleToken.GetObjectText_()
WScript.Echo "Assignment:" & SMS_ScheduleToken.StartTime

Next

'begin modifying:

strNewComment = "Updated by vbs"
Advertisement.Comment = strNewComment

'This next line will modify the Advertisment with settings set in variables above.
Advertisement.Put_

Next
End Function

Scripting SCCM to refresh a package source directory

2008-09-16T07:17:00.000-07:00

My company has a need to have a particular package's distribution points update automatically when a file in the package source directory changes. We looked at the package's built in option to automatically update DP's on a schedule. Ultimately, we decided this would not work. We have a very short window to obtain a 4GB updated package source and then distribute that content to clients. If we set the window too small (every 20 minutes), then clients would be mostly locked out from getting content from the DP, since the DP would be constantly updating. If we set it too large, we don't get the content within the targeted time window. Using the SCCM SDK ( http://www.microsoft.com/downloads/details.aspx?FamilyId=064A995F-EF13-4200-81AD-E3AF6218EDCC&displaylang=en ) and information from a post by aparrott on myitforum: http://www.myitforum.com/forums/m_180582/mpage_1/key_/tm.htm#180582 we were able to create our own script that will detect the change and then update the DP. I have a scheduled task that runs every 20 minutes. If the last modified stamp on the text file is different, then the DP's will update. This happens once a day, but I get new content onto the DP's within 25 minutes. Now I just need to delete the old mandatory assignment and create a new one.

Careful of the wordwrap! I suggest you copy and paste into notepad.

'==========================================================================

' VBScript Source File -- Created with PrimalScript.

' NAME: SCCM_Refresh_DP_Nightly_Build.vbs

' Created by: Bill Phillips, ESRI

' Date: 09/15/2008

' COMMENT:

' Run this as a scheduled task under the System account.

' Machine's account must have rights to the shares.

' Example code from: http://www.myitforum.com/forums/m_180582/mpage_1/key_/tm.htm#180582

'==========================================================================

On Error Resume Next

' --- Set Variables

siteName = "tst"

serverName = "SMSSERVER"

SMS_PackageID = "tst00158"

' --- Create Objects

Set loc = CreateObject("WbemScripting.SWbemLocator")

Set WbemServices = loc.ConnectServer(servername , "root\SMS\site_" & siteName)

set FSO=CreateObject("Scripting.FileSystemObject")

CompareFiles()

' --- Compare Files

Function CompareFiles()

Set objSourceBuildNumTextDate = FSO.GetFile ("\\smsserver\source\foo.txt")

Set objDestBuildNumTextDate = FSO.GetFile ("\\dpserver\SMSPKGE$\tst00158\foo.txt")

If not objSourceBuildNumTextDate.DateLastModified = objDestBuildNumTextDate.DateLastModified Then RefreshPKG

End Function

' --- Refresh Package

Function RefreshPKG()

Set packages = WbemServices.ExecQuery("Select * From SMS_Package where PackageID = '" & SMS_PackageID & "'")

For Each package In packages

Package.RefreshPkgSource( )

End Function

Searching Config Manager Docs on Technet

2008-09-11T06:45:00.000-07:00

As many of you know, searching Config Manager documentation on Technet is a PITA! Fortunetly Jeff Gilbert has figured out how to narrow your Technet search down to just the Config Manager docs. http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2007/11/07/how-to-more-easily-search-the-configuration-manager-documentation-library-online.aspx
This should make life significantly better. Can't believe I haven't seen this before now.

Deployment of Vista msu with License Agreement

2008-09-10T07:10:00.000-07:00

Just came accross an issue where Vista will ignore the /quiet option for Wusa.exe if the MSU file (a Vista patch) has a built-in license agreement. To fix this issue, you must install a hotfix:

http://support.microsoft.com/kb/929761

Deployment of Group Policy Preferences Client Side Extensions

2008-09-09T07:02:00.000-07:00

Yesterday my Group Policy Admin asked about deploying the Client Side Extensions (CSE's) for Group Policy Preferences (GPP) to all the machines in our network. So I started looking into it and must say I'm very dissappointed with Microsofts support for the deployment of CSE's. Sure CSE's are available in WSUS and therefore available in SCCM. However, they haven't released CSE's for XP SP3 yet. Additionally, the CSE's have a prerequisite of XMLLite. Unbelievably, XMLLite is not available via WSUS. The work around is to deploy IE7 which includes XMLLite. All of this is a little confusing so I made a chart:

Basically I'll create 2 seperate collections for XMLLite to deploy it to the machines that require it. Then I'll use Software Updates to deploy the CSE's. XP SP3 will just have to wait until Microsoft gets it done. Hopefully they're working on CSE deployment with XMLlite bundled in.

Config Manager Software Updates

2008-09-05T18:30:00.000-07:00

Why is config Manager's software update process so confusing? Today I finally figured it out. It's because an advertisement can get content from multiple packages! Think about it. In a traditional software distribution you have 3 objects to worry about.

1. Collection - Target computers

2. Package- contains the files and the commands (programs) that you want to distribute to clients and execute.

3. Advertisement- Matches the Package to a collection to execute at a specific time.

Now in a Software Update you have 4 objects:

1. Update list- A type of template its just a simple list of updates worthy of attention. This is the object that doesn't exist in normal software distribution. It's designed to make life easier since you can group together updates in a way that fits your business needs.

2. Deployment Templates- A template of settings that may or may not apply to a particular collection.

3. Deployment Package- Very similar to a regular package this item contains the updates but doesn't have any command line options since the sccm client will kick off the wua to do the install. It is basically just a storage location.

4. Deployments- located under Deployment Management- this is actually just a very special advertisement. It contains it's own list of updates that are not what necessarily what is in an update list or deployment package. The reason for my confusion. Basically it is an independent object that can grab updates from multiple packages.

The basic thing to remember is that adding content to a Deployment Package, does not add that content to the actual Deployment (advertisement). After updating an existing package the updates must be either added to an existing deployment by dragging an update list onto the deployment, or creating a new deployment.

Best thing about Chrome

2008-09-05T05:52:00.000-07:00

Okay, I'm still in love with chrome. zdnet has a write up about the top 5 things in chrome. My favorite feature (about:stats) didn't make the list but check the rest out:

http://blogs.zdnet.com/BTL/?p=9878

is sccm client backwards compatible with sms 2003

2008-09-04T07:06:00.000-07:00

For those of you wondering, the sccm client is not backwards compatible with sms 2003. However, the sms 2003 client is backwards compatible with a SCCM environment. Basic rule of thumb regarding SMS/SCCM is that the highest version must be at the top of the hierarchy. So if your upgrading, you must either upgrade your central site first, or build a new SCCM site and point your sms central site to the SCCM site as its parent. Then you work your way down the hierarchy upgrading Parent servers, then child servers, and secondary servers. Never upgrade a server unless the server above it is already upgraded. Once you've upgraded your entire environment, figure out how clients are going to determine their management server. After you've put this in place the last thing to upgrade is the client.

Google Chrome goals

2008-09-03T07:01:00.000-07:00

A lot of people are wondering why in the world would Google want to release a webbrowser? We already have 4 biggies: IE, Firefox, Opera, and Safari. A 5th one just further splinters the market and makes life harder on web developers right? Actually, what Google is trying to do here is increase visibility of the webkit engine that both Chrome and Safari is based upon. This also happens to be the engine Google has stuck into it's mobile OS Android. If Google ever wants to see Android succeed, it has to make sure that it displays the web properly. The only real way to do this, is to get web developers to code and test against it's webkit engine. By releasing another browser based on webkit, Google may actually increase the overall web presence of webkit and therefore increase usability for it's Android based devices. I say this is another smart move by Google.

Google Chrome

2008-09-02T19:55:00.000-07:00

Today Google announced their new Chrome webbrowser. http://www.google.com/chrome Based on webkit the same engine that powers safari, iphone, and Google's own Android, chrome is a welcome breath of fresh air. I've been runing Chrome all day so far and found it very usuable. I'm even blogging this post from within Chrome. My biggest complaint? Google should have made an effort to support plugins. It'd be even better if they could support existing Firefox Plugins. I simply can't live without Ad-block plus, and after today I'm sure I'll be back to Firefox due to this one shortcoming.

Time to start over

2008-09-01T18:30:00.000-07:00

This past week I found out that one of our management servers had sccm installed on the c:\ drive. You'd think there would be a setting to change the storage location so that the program could still run from c:\. Apparently there is no such option. Only option is a site uninstall and reinstall. Of course if you uninstall, you can't reuse the same site code. Doing so would have dire consequenses including corrupting the site database. Digging around I found a nice article by Anthony Clendenen on removing a secondary site in SMS 2003. The steps outlined by Anthony allow reusing the existing site code. I'd previously used this article to remove and reinstall a Primary 2003 site. After looking at some of the registry keys and file folders on my SCCM site install, I decided to try the same steps on my SCCM primary site. Guess what? It works! Here's the article:
http://www.myitforum.com/articles/8/view.asp?id=9472

MMS 2007

2007-04-01T17:06:00.000-07:00

Okay I haven’t posted in a while. I’m sorry. I had a couple of big events come up that took precedence. First I had to setup and administer the computers systems for a small conference (70+ machines). I decided against using SMS for this conference, so I took myself out of the SMS loop. The 2^nd event was the Microsoft Management Summit (MMS 2007). This event is all about SMS and the upcoming Systems Center Family. The Systems Center family includes Operations Manager, Configuration Manager, Data Protection Manager, Essentials, Virtual Machine Manager, and Capacity Planner. System Center Configuration Manager is the important one here. It’s actually the next version of SMS. SMS v4 will officially be called Systems Center Configuration Manager (SCCM 2007).

At MMS 2007 I learned all about the cool features that SCCM 2007 will be providing. There are tons! If you haven’t yet, get Beta 2 of SCCM 2007. I will be installing it this week and giving a review of my experience. I can tell you that at the SMS 2003 to SCCM 2007 upgrade lab, the process was very easy. MMS 2007 has also convinced me to install SMS SP3 once it’s available. My original plans were to skip SP3 and wait for SCCM 2007. However the additional reports and collections regarding Vista has forced me to reconsider this decision. SP3 is now a must have for me.

BITS Bites me

2007-02-08T18:29:00.000-08:00

So we are trying to push out the client to a couple of our Regional Offices (RO’s). Our preferred method (meaning method used by the old admin) is to use the free client health tool by 1E. http://www.1e.com/Downloads/FreeTools/index.aspx

The advantage of this tool is that it is a startup script that checks to see if SMS is working properly. If it isn’t working properly (or isn’t installed), then it re-installs it. It works better than the built in client push method since you can control who gets the startup script via group policy. It also will email the designated admin if it can’t install properly and give you a reason.

Lucky for me, my email box received 20 emails today about out of date BITS (Background Intelligent Transfer Service). SMS can’t download and run a package if BITS doesn’t work properly. According to Microsoft, the most current version of BITS is 3.0 (http://www.1e.com/Downloads/FreeTools/index.aspx)

Now if only there was a place to download BITS 3.0 for distribution... Best I could find was BITS 2.0 here: http://www.microsoft.com/downloads/details.aspx?familyid=B93356B1-BA43-480F-983D-EB19368F9047&displaylang=en

If anybody knows more info, please let me know.

ITMU update goes smoothly

2007-01-30T20:05:00.000-08:00

The last week has been pretty uneventful. Yesterday, I installed the ITMU update on my test server. It updates the packages, collections, and advertisements as expected. It also adds in the 64 bit ones as well which will be nice if we ever let our users run the 64bit OS I suppose. The only disappointing part is that nothing in the install is configurable. We don’t use the default collections or advertisements, so we’ll have to update these on our own I suppose. Not a big deal. So I send out the change control and let everyone know that the clients will receive an updated Windows Update Agent (WUA).

Today we went ahead with the ITMU update on the production environment. Once again it was uneventful. The only minor detail was that we changed advertisement related to the scan package (Microsoft Update Tools) to use a test collection. One can never be too careful! Note, this package has the dependency to run the WUA package first. The WUA package should only run on computers it has not already run on, so in theory it will only run one time. Hope we don’t have too many failures. In any case it was no big deal. We updated the ITMU, and then updated the distribution points. We did note was that the old admin was not using every site server as a DP for this package. Since we didn’t see a reason not to have the package on every DP we fixed that issue. One final note is that I couldn’t find evidence of the package running on my test system. But mine already had the updated WUA so maybe it did. I have the other admin check his test box tomorrow and then we’ll change the advertisement back to use our normal collection.

Day 9: Heartbeat Discovery

2007-01-25T08:26:00.000-08:00

So I’m ready to install ITMU on my test setup and I get to the point where it asks for a sync client. I decide to use the site server (against Microsoft advice, but it’s the way our production environment is currently configured). My problem is that the ITMU setup says that my site server is not a client. I double check the All Systems collection and I see it. But upon closer inspection the Site Code column is empty and the Client column says No. In fact is also says this for my actual xp client machine that is in the test domain. So I run ccmsetup.exe from \\siteserver\smsclient\i386 . Client is installed. Start>Control panel>Systems Management. On the advanced tab, the currently assigned to site code field is empty. I click discover. Viola! It discovers my test site. Switch back to the SMS console>Collections>All Systems. No change. How disappointing. F5. No Change. More disappointed. Right click>All tasks>Update Collection Membership. No Change. This is starting to bother me. Right click on the client>Trigger Discovery Data (you need the right click tools installed for this option to be available). Get the Right click tools from Stuart Watret at http://offshore-it.co.uk/ . Still No Change. Back to the client>Systems Management>Actions tab> Hardware Inventory Cycle> Initiate Action. Come back an hour later. No Change. I go back and forth before I put my time tested Googling skills to use. Google: collections client no sms installed. 4^th link down has the answer. It’s the heartbeat discovery. Not really sure how it differs from the AD System Discovery but it does. SMS console>Site Settings>Discovery Methods>Heartbeat Discovery>Right Click>Properties. It’s enabled, but by default set to once every 7 days. Since this is my test site, switch it to once every hour. Back on the client side> actions tab> Discovery Data Collection Cycle> Initiate Action. Back to the Site Server. Collections>All Systems>All tasks>Update Collection Membership. Ahhhh. Sweet SMS goodness. Instantly the two systems show up as assigned, client = yes, client type = advanced, etc. It all looks good. Back to ITMU!

I really need to get the SMS administrators book and figure out how all this should work.

Day 8: Critical Error 4909

2007-01-23T08:58:00.000-08:00

So today my test site server was showing critical error 4909 with description:

SMS Systems Management Server could not locate the "System Management" container in Active Directory. Nor could it create a default container. This will prevent Site Component Manager from updating or adding any objects to Active Directory.

Possible cause: This site’s SMS Service account or the site server’s machine account might not have the correct rights to update active directory.

Solution: Either give the Service Account rights to update the domain's System Container, or manually create the "System Management" container in this domain's Active Directory system container, and give the Service Account full rights to that container (and all children objects.)

Since I’m knew at this stuff I had to figure out what it meant to give rights to the system account in AD.

Well after a bit of googling (googled: create the System Management container, 5^th link down), I came across this Microsoft KB article.

http://support.microsoft.com/kb/830022/en-us?spid=2890&sid=global

Step by step instructions. Basically in AD, you have to give the computer that SMS installed on, rights to the “System” folder aka container. Make sure you give it permissions to all child objects as well. If you’ve done it right, there is a new container object under System called…..System Management

The end of the instructions instruct you to Restart the SMS Site Component Manager service to start updating Active Directory. Of course Microsoft fails to mention how to do this, and the only people who need to know are the ones who don’t have SMS working i.e. meaning people who just installed it and may not know how to check a SMS service. Guess I can be nice and tell you. Back in the SMS console expand the site database>Tools>SMS Service Manager. You’ll see an empty pane. Very intuitive isn’t it? Anyways right click in the empty pane>All Tasks> Start SMS Service Manager. Expand your site>Servers> Machine name of your site> Pick the SMS_SITE_COMPONENT_MANAGER. Now things get really silly. You can’t tell if it’s running or not unless you query it first. Pick the component from the rights side and hit the query (!) button. Now that you can see it running, you can stop it. You’ll have to query it again to see that it actually did stop. Then you can hit Start, query it again to make sure it started. Now switch back to AD and check your new System Management container to see if SMS has put anything in there.

Day Seven: Test Environment is working

2007-01-21T16:29:00.000-08:00

Well I finally got the test environment up and running. Had a little trouble because I forgot to change the SID on one of my VM machines. I took a shortcut and copied the VM machine folder instead of reinstalling windows 3 times. This of course caused trust issues with the domain since all the workstations had the same SID. Symptoms of this phenomenon include not being able to login to the domain on the workstation, and the domain administrators group not being included in the Local Administrators group of the workstation. The quickest way to resolve this is to move the machine back into a workgroup, Reboot, Run NewSID (http://www.microsoft.com/technet/sysinternals/Utilities/NewSid.mspx), Rejoin the domain, Reboot (again), and try to login using a domain account.

Sidenote: NewSID is an excellent tool developed by Mark Russinovich and Bryce Cogswell. It’s an interesting fact that Microsoft does not actually support the use of NewSID despite is availability from the Microsoft website. This is due to the fact that NewSID was developed by Mark and Bryce under their own company, Winternals. Microsoft bought them up and allowed them to rerelease their tools on Microsoft Technet with the disclaimer that it is not actually supported by Microsoft. Personally, I’ve used NewSID quite a bit and have never had an issue. However, if you wish to do things the right way, then Microsoft recommends running Sysprep. This tool will actually do lot more then generate a new random SID, so I’d advise just using NewSID.

Back to SMS and my test environment. Tomorrow I plan to apply SP2 to SMS and install the first revision of ITMU to accurately reflect the production environment. A quick patch update test should show everything working the same as it does in production. Then apply ITMU ver. 3 and another update test. If all goes well, I’ll be updating ITMU on the production server real soon.

Day Five and Six: ITMU and the Test Environment.

2007-01-18T19:29:00.001-08:00

Hey can you look into updating to ITMU v. 3? I think we need it by March. I actually got this email from admin no. 3 a couple of days before we did the patch update. It was the first time I had heard of the Inventory Tool for Microsoft Updates aka ITMU. Researching what it was and why it need to be updated by March actually really helped out with the patch updates we did, since I had some idea of how Microsoft intended the monthly updates to be deployed. Guess what? It really does need to be in place by March. Microsoft will stop updating the old one and ITMU will break if we don’t update. Lucky me, I get a chance to break our patch system within the next 2 months. Actually, I don’t think it will be a big issue. We already have ITMU installed, so we meet all the current prerequisites. Version 3 has the same requirements, so we’ll just need to walk through the install. However, being the good little admin that I am, I pushed that we needed to walk through it on the test environment first. No problem, since it’s all on Virtual Machines. Well it wouldn’t have been a problem, until I found out that the old admin wiped all his boxes the day he left. His SMS test environment was completely lost. No DC, no parent site server, no child site server, and no clients.

Needless to say, days five and six have been an excruciatingly long effort to recreate the SMS test environment. Everything from installing Win2k3, Active Directory, Creating user accounts, Installing SQL server, IIS, BITS, SMS, SMS SP2, etc. You have to extend the AD schema? Give the SMS computer permissions to AD? Who came up with this insane procedure? I’ve installed SMS before, but I always hate doing it. I keep promising myself, this will be the last time. I’ll make nice backups of my VM’s and find some place to store them. Yeah right, in 9 months I’ll have a need to start over. Something will break and it’ll be easier to do a clean install than fix it. I didn’t quite finish today, so the whole thing will be waiting for me tomorrow. I hope I don’t hit any walls.

Day Four con’t: The 2nd meeting

2007-01-17T22:31:00.000-08:00

The second meeting we had yesterday (why does every company have so many meetings?), involved scheduling the patches for the rest of the company. At our company we actually send out 3 packages at once. The first package is the patch notice. It informs our customers (IT world translation: end-user) that their machine is part of the SMS patch program and is targeted to receive the latest patches. It also gives instructions for calling helpdesk (I’m sure helpdesk is thrilled that we give that extension out every month to every customer). The notice is available starting at 8:00am and the advertisement runs for 8 hours (5:00pm). If the customer clicks okay, or 8 hours passes and the notice closes itself, the program package ran successfully. At 11:00pm, the Microsoft Patch Update program runs. This is the same program created and updated by ITMU. We advertise it to run for 3 days. It ends at 10:00am on the 3rd day. This way we catch laptop users and people who take a short week. The third program is advertised starting on the 2nd day. This is a reboot notice. We don’t actually reboot machines, instead we let the customer do it. The reboot notice checks the registry to see if the customer has a patch pending reboot. Patches that quit with exit code 3010 will create a temporary reg key for that update: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\WindowsUpdate\AutoUpdate\RebootRequired\DWORD value of each update ID that requires a reboot and sets the value to 1. If we don’t find a key = 1 then the reboot notice is suppressed. If there is valid reboot key, then we display a notice that alerts the customer. The customer may delay the reboot by clicking okay, but not kill the notice. It will pop up again later, until a reboot happens, or the advertisement expires, 8 hours later.
Get the script from Microsoft here:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wua_sdk/wua/using_wua_to_scan_for_updates_offline.asp

We had 4 different collections to setup of all 3 package advertisements for. The first one went out to the entire systems group. It was one last chance to find a problem before hitting the rest of the company, so all of its packages are advertised one day earlier. The second group was our normal internal lan. Known as the Business Network, it hits all our standard operational departments (marketing, accounting, contracts, etc.). The third group was our developer network. Our developers are currently given a choice about having SMS update their system. The ones who opt out must be able to provide a valid reason, so we separated the entire network to make administration a little easier when dealing with the rest of the company. The last network was our RO’s (Regional Offices). We’ll probably roll them into the business network eventually, but for now they are separate.

We did hit an issue with the RO’s, the old admin had a 3 hour time difference for some parts of the patches but not for all. We spent an hour debating if SMS used the Parent Site time, the Child Site time, the DP time, or the client time. While we were certain that most machines in the lan were joined to the domain and therefore had the right time, we couldn’t be as sure about the RO’s. Also, if all the RO’s are in one collection and we start something at 8:00 am our time (Pacific), then it really starts at 11:00 eastern. If we start it at 5:00 am our time then how does that affect things that are expected to run until 5:00pm since they would now be ending at 2:00pm. At one point Admin no. 2 thought that checking the Greenwich Mean Time checkbox would be a good idea. We eventually convinced him that it wasn’t. We finally settled on running the notices at the earlier adjusted time, but running the patch at our local 11:00pm time, which was 8:00pm eastern. Anybody still working at 8:00 and noticing a slowdown should just call it quits for the day.

Day Four: SMS success!

2007-01-16T17:00:00.000-08:00

Maybe SMS success is an oxymoron. My current measure of success is not breaking the existing infrastructure. Deploying a package is just extra icing on the cake.

One thing I forgot to mention is that just before we left on Friday we did create a test collection with two test machines. Then we created the test advertisement and crossed our fingers.

Monday was a holiday for us. So today was our first chance to see if the patch deployed. I came in, checked my test machine and there was our custom made post patch reboot message. Firing up the SMS console revealed that the packages ran successfully (not that I expected anything less).

The best way (that I’ve found) to figure out if your packages ran on a test group is to open up the console, expand the Site Database>System Status>Advertisement Status. Select the advertisement you’re interested in checking. Then in the right pane you can see the how many clients received the package, how many started it, success, failures, etc. If you want to get really detailed you can right click on your site>show messages>all. I usually only need to look at the last day or two but you can go back further if you need to. The description column will report back every action that was taken and the results of that action. I think it’s better then any of the reports I’ve found.

Since it was the first day of the week, it was time for the meetings to start. First meeting: Discuss the implementation of SMS in one of our classrooms. The Sys admin for the classrooms manages 5 classrooms of 16 machines each. They are firewalled off from the rest of the company, but holes can be opened up for specific needs. He’s still using ghost to re-image the machines before every class. The problem is, he has 16 different images and some of them fall behind in patch levels. The old admin started a project to get SMS implemented in these classrooms. After hunting around for a few days we found the servers. He setup a child site and a separate machine for dp. We figured the child site is inside our internal firewall and the dp is on the classroom side of the firewall. At this point we assume the correct ports have been opened, guess we’ll find out. A little bit of discussion and we determine that he can automatically run the sms client install after ghosting. Now things get interesting. How do we schedule advertisements such that, the machines are kept up-to-date but no patching takes place while a class is in session. It occurs to me that if he can run a command line automatically after patching then we have a patch solution in place already, currently in use by our new computer deployment team. They use a combination of a WSUS (Windows Server Update Services) Server and a script that updates the Automatic Updates client, forces all the settings, connects to the WSUS server, updates, reboots, logins and continues until the machine is patched.

WSUS? Isn’t that SMS blasphemy? Well hold on before you crucify me. Remember all we are really interested in, is patching classroom machines that get re-imaged several times a week. The software is already installed on the images and we are not patching non-Microsoft products. Plus this solves the scheduling problem, since the patching takes place automatically, immediately after imaging. It’s the right tool for this job.

The idea is well received by the other admins. In the end we agree that SMS is still important to implement, we want the reporting and we see the benefit of creating software packages for the future, and one day we may switch him from Ghost to OSD. Plus it buys us time for him to get the images updated with the client.

Meeting Two will have to wait until my next post.

Day Three: Reality check

2007-01-14T13:03:00.000-08:00

Did I say SMS administration wasn’t a full time job and that ITMU was the end all savior answer to our SMS prayers? Time for that reality check.

So here’s what actually happened on Friday. I setup a meeting with admin 2 and 3. I bring my laptop and a projector so we can all see what’s going on. Combined with the patch update document left by the last admin and a little knowledge based on my readings about ITMU, we figured an hour was plenty of time to setup the patch advertisement. Just to be sure I blocked out an hour and half for the meeting. On our agenda: update the existing Microsoft Update patch package to include the January patches, and advertise it to a test group. The patches themselves had already been tested and approved for our environment. Our job was to simply integrate it into SMS and start the monthly company patching process.

Here’s Microsoft’s diagram on how this should work: https://www.microsoft.com/smserver/techinfo/administration/20/using/suspackhowto.mspx

So looking at the document left by the old admin and dated July 2006, we think we have a pretty good handle on how to start this process. Step 1> Right click on the correct advertisement and choose the option to distribute software updates. Well which advertisement is the correct one? Certainly not the one for the entire company. But, there doesn’t appear to be a good test advertisement setup. How can this be? Obviously, something is wrong with this document and we’re only on step one. Okay, no problem. We are three very bright admins (there are 30 Systems Administrators at this company), and the each of the three of us would definitely rank within the top five category for our company. Surely we can figure this out and move on. We start by exploring the options available for every type of object. Strangely, distribute software updates is available via packages, collections, and advertisements. Well, we know we want to update the package, so let’s proceed from there.

Step two: Pick the correct scanning tool (the screenshot show MBSA). We’ll that doesn’t strike us as correct. The DSUW has Microsoft Updates already listed, and based on what comes up in the rest of the wizard (yes we poked around), it appears to default to the values chosen the last time it was run. Additionally, Microsoft’s ITMU documents also appear to use Microsoft Updates. Keep in mind, our company has had SMS in place for 4 years now. The list of scanning tools available include MBSA, Windows update, Office update, and Microsoft Update. Our best guess, Microsoft Update supersedes all the other tools since it combines the features of Windows Update and Office Updates in order to Update both in one shot. This conclusion was reached based on our knowledge of the difference between Windows Update, Office Update, and Microsoft Update’s respective websites.

Moving on to step three: Pick the Q number of the patches to include in your package. Our understanding at this point is that the sync tool has already run and these patches should already be in the package source. Click a couple of corresponding checkboxes and move on. How wrong we were. Since the patch test group had already downloaded the patches and tested them, I know the network share to look at and find the appropriate patches. They are kept in the share and organized by year and then by Microsoft Bulletin number. Example is \\share\2007\MS07-002 . This folder refers to this bulletin: http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx

As you can see in the bulletin the Office 2000 version of the patch is KB925524. The network share lists each file that was downloaded and the first file in the list is office2000-kb925524-fullfile-enu.exe. Cool, let’s type that into the filter and check the box! Only problem is, 925524 doesn’t return any results. How can this be? Did the sync tool not run? We need to check things out. So we spend the next hour looking for reports, queries, advertisements status queries, checking package source folders etc. As best as we can tell, the sync tool ran on 01/09/07, aka patch Tuesday. So where in the world is 925524? Shouldn’t it be in there? Can Microsoft make this any more difficult? Why isn’t this working right? I’m sure some of the SMS veterans and Security folks would get a real kick out of this train of thought. An hour or so later it’s time to admit defeat and move on to the next one. Excel 2002/xp number KB925523, comes up without an issue. Check a bunch of boxes and we feel pretty damm good. So what happened to 925524. Let’s poke around some more. It’s time to actually read the bulletin. Look at that, MS07-002 has a number next to it: 927198. Maybe that’s the Q number we should be typing in? At this point, I admit we’re lost. I type in every number I can find, check the boxes that come up and ignore the ones that don't. Hopefully the old admin will answer our emails before we deploy to the company.

The rest of the process pretty much proceeds as expected. Updates get downloaded. DP’s get updated. We choose not to update the collections and advertisements, because we want to do it ourselves and not screw up the company (yet).

The hour long meeting only took 4 hours! This SMS stuff is easy as pie.

Day Two: The SMS saga continues

2007-01-13T06:52:00.000-08:00

It's my day off, but I want to go over some of the things that happened yesterday.

I confess. I do have some rudimentary understanding of how SMS works. Before the old Admin left I had worked with him on creating a package for deploying Microsoft Project 2003. Also, as I’ve said before, I did most of the implementation of the OSD Feature Pack. Just to give you an idea of where I’m coming from, since we currently do our deployments using the OSD deployment CD, there are no collections or advertisements involved. Also, Image packages are slightly different than regular packages. Not much, but enough so that Microsoft has made it a different object within SMS.

I also did find some of the documentation left behind by the old admin. As I alluded to in my first post, this documentation was buried in a sea of files that dated back to 2003. Many of the processes and procedures that were documented were no longer relevant. However, being the clever SMS admin that I now am, I sorted the documents by date and started working my way backwards from newest to oldest. After 4 hours I had accomplished the task of putting a copy of the current and relevant documents in another network share, which I shared with newly minted SMS admin 2 and 3.

What little jewels did I receive for my hard work? Well besides a pat on the back there was an up-to-date copy of the current SMS Hierarchy. Our site has close to 20 SMS servers! Most are actual site servers with several primary and a couple of child sites. Some are simply distribution points. Is this the best setup? Only time will tell.

In addition to the SMS Hierarchy, I managed to salvage a copy of our implementation of the Microsoft Patching procedure. It had screen shots and detailed step-by-step instructions! Everything you would need to administer Microsoft Patches via SMS. The old admin has actually installed ITMU (Inventory Tool for Microsoft Updates). After a little reading up on ITMU, this little gem was going to be the answer to all our prayers. ITMU will sync all the patches available on Microsoft update with the SMS server using a designated Syncing machine. Then it updates the existing Microsoft Updates Tool package with the new patches. After that it will allow you to test the patches on a pre-production environment. Finally, it will allows you to deploy the updates to the rest of your machines. Life was looking pretty sweet. SMS isn’t really a full time job is it?

Next time: Microsoft best practices and reality clash.

Day One: The SMS Admin has left the building

2007-01-12T23:11:00.000-08:00

The SMS Admin has left the company. There are no useful documents. If your lucky there are some buried in the sea of network shares, but most are outdated or poorly written. It’s Mission Impossible. Your mission, should you choose to accept it, is to take over SMS and all of its associated projects and duties without bringing down the company. No this isn’t really optional, but it’s the position I found myself in today, and with patch Tuesday already 3 days old the task wasn’t going to disappear to the bottom of my to-do list.

So what does one do when the reins of SMS have been handed over and the old admin isn’t around to ask questions? I had a little experience with SMS since I helped implement the OSD feature pack. One of the other Admins had experience since he helped install it (3 years ago). Admin number 3 attended a couple of classes, but really didn’t have a clue regarding SMS. It was crunch time and today was day one.

Step one: Install the SMS console. This can be done on any machine and is used to connect to the SMS site server and DP. You can cheat and use the console installed on the server, but who wants to do that? It’s on the SMS CD but in the real world your SMS server is version 2003 and SP2 is installed. The CD won’t help since the latest version is needed which you can get direct from Microsoft: http://www.microsoft.com/downloads/details.aspx?familyid=37B20B4B-DFEC-464D-908B-5D783E2370D3&displaylang=en

Run SMS2003SP2.exe /x

Autorun.exe will get the client tools installed and contains the latest version. It’s probably backwards compatible. So even if your previous admin wasn’t up to par, you can connect to the site server and administer SMS

Step two: Start the console and connect to your central site server. Use the machine name when prompted not the site code. If you didn’t get console on your local machine you can cheat and RDP to the SMS server. You’ll need admin rights either way.

Step three: Look around and see what the previous admin left.

There are 3 primary terms to get familiar with in SMS. 1- Packages 2- Collections 3- Advertisements.

Packages:

A package is a group of source files necessary to run a particular program. In most cases you want the setup program files. It also contains the command line to run. A typical command line is msiexec /I foo.msi /qb. Go ahead and make one. You’ll be asked to update the Distribution Points with it. Nothing is going to the clients so feel free. A good harmless one has no source files just a command line: notepad.exe. Just like start>run>notepad.exe this will cause notepad to pop up. If you choose the option to run it under the system account instead of the local user account then nobody will see it, but it should appear in task manager when the all users option is checked.

Collections:

Collections are simply a group of computers. It can have one or many computers in it. Look for an existing test collection with computers you are familiar with. Better yet, create a new one with one of your test machines in it. You’re not gonna screw anything up by creating one. Don't mess with any of the existing collections some of them are created with a SQL query.

Advertisements:

Advertisements tie Collections and Packages together. This is where you can do damage. Creating an Advert involves telling SMS which packages should go to which collections and when. The wizard is pretty self explanatory, just make sure you pick your notepad package and the collection is your test collection.

Congrats you just did your first SMS deployment on the test server and didn’t bring down the company. (you weren’t practicing on the production server were you?). I’d call this a successful mission. Coming up in Day 2: What the hell is going on with the SMS environment?