Mastering System Center Configuration Manager

Table of Contents

Mastering System Center Configuration Manager

Credits

About the Author

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Instant updates on new Packt books

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Errata

Piracy

Questions

1. Introduction to System Center Configuration Manager 2012 R2

System Center Configuration Manager 2012 R2 – requirements

Prerequisites for System Center Configuration Manager 2012 R2

Creating the System Management container

Extending the Active Directory schema for SCCM 2012 R2

Installing Windows Server's roles and features

Installing ADK 8.1 for SCCM 2012 R2

Installing MS SQL Server 2012

Installing Windows Server Update Services

Installing System Center Configuration Manager 2012 R2

Site system server and roles

Site administration

Planning and deploying sites

Monitoring and maintaining the hierarchy

Summary

2. Assets and Compliance

The benefits of centralized system management

Managing compliance

Configuring compliance settings

Configuration items and baselines

Configuration items

Configuration baselines

Baseline deployment

Compliance evaluation

Configuration packs

Exporting configuration items and baselines

Compliance authoring

Organization

Using Microsoft tools

Security Compliance Manager

CP Studio

The compliance strategy

Endpoint Protection

Prerequisites for Endpoint Protection

Planning for Endpoint Protection

Creating client settings and antimalware policies

Deploying to a test collection

Installing the Endpoint Protection role

Setting up a software update point for Endpoint Protection

Configuring the SUP to synchronize definition updates

Creating autodeployment rules for definition updates

Working with antimalware policies

Understanding the default antimalware policy

Creating a custom antimalware policy

Importing and merging antimalware policies

Merging policies

Configuring alerts for Endpoint Protection

Configuring e-mail notifications

Alert subscriptions

Configuring custom client device settings for Endpoint Protection

Deploying Endpoint Protection for custom client agent settings

Monitoring the status of Endpoint Protection

Configuring collections to appear in the collection view

Security state view

Malware remediation status

Top malware

Monitoring malware details

Monitoring Endpoint Protection details

Performing on-demand actions for the malware

Reporting in Endpoint Protection

The Endpoint Protection client

Installing the Endpoint Protection client

Understanding Endpoint Protection client settings

Automatic removal of antimalware software

Removing the Endpoint Protection client

Delivering definition updates

Summary

3. The Software Library

Introducing packages

Programs in Configuration Manager

Collections

Distribution Points

Deployments

Combining the use of packages, programs, collections, and deployments

Creating a package

Package properties

Program properties

Creating a package with the new package wizard

Custom packages

Repackaging software

Avoiding common issues

Testing packages

Creating and managing applications

About applications

About deployment types

Requirements as a component of a deployment type

Global conditions

Detection methods

User Device Affinity

Creating applications

Creating a Windows Installer application

Application properties

Creating deployment types

Creating a Windows Installer deployment type

Creating an application virtualization deployment type

Creating a script-based deployment type

Creating detection methods

Detection methods for a Windows Installer application

Other detection methods

Custom script detection methods

Custom detection methods with PowerShell

Managing applications

Dependencies

Revision history

Exporting and importing applications

Superseding applications

Application retirement and deletion

Package conversion

Operating System Deployment

Summary

4. Reporting in Configuration Manager

SQL Server Reporting Services

Implementing SQL Server Reporting Services

SSRS requirements

SQL Server Reporting Services installation

SSRS configuration

Role-based access control

Accessing SSRS Point

Data sources

Backing up SSRS

Reporting best practices

Reports in the Configuration Manager console

Creating a subscription

Managing SSRS report security

Creating a report

Creating custom reports

Development tools

Building a custom report

Interactive features of reporting services

Advanced custom report example

Authoring best practices for report development

Troubleshooting SSRS

SSRS logs

Optimizing SSRS performance

Subscriptions

Report caching

Report snapshots

Report timeout values

Best practices for performance

System Center Data warehouse

Summary

5. Administration and Monitoring

The Configuration Manager's discovery methods

Hierarchy planning

Configuration Manager sites

Central Administration Site

Primary and secondary sites

Hierarchy-wide site system roles

Planning your hierarchy structure

Planning boundaries and boundary groups

Client discovery and installation methods

Role-based administration

In-console alerts

Managing alerts

Configuring alerts

Subscribing to alerts

Client settings

Defining a priority

Background Intelligent Transfer Service device settings

Client policy device settings

Mobile device client settings

Compliance settings for device settings

Computer agent device settings

Computer restart device settings

Hardware inventory device settings

Network access protection device settings

Power management device settings

Remote control device settings

Configuring remote control and remote assistance

Using a remote control

Remotely administering a client computer

Providing remote assistance

Software deployment device settings

Software inventory device settings

Using Resource Explorer

Summary

6. Cloud Integration

Cloud integration – prerequisites

Subscribing to Windows Intune

Adding the Windows Intune subscription to Configuration Manager

Mobile device management

Configuring the Windows Intune connector role

Mobile device enrollment

Mobile application delivery

Cloud distribution points

Cloud distribution points – prerequisites

Creating certificates

Importing the certificates in Windows Azure

Creating the cloud distribution point

Configuring DNS for the cloud distribution point

Summary

7. Security and Backup

Administrative users

Security roles

Built-in roles

Custom roles

Security scopes

Associating security scopes and collections with individual roles

Preventing unauthorized administrative access

The Active Directory security

Securing access at the database level

Auditing the Configuration Manager's administrative actions

Securing the Configuration Manager infrastructure

Building security into your hierarchy

Securing site systems

Physical security and hardware selection

System software security

Attack surface reduction and server hardening

Security software

Securing the site system's local administration

Securing the site database

Configuration Manager's network security

Client-to-server communications security

Server-to-server communications security

Site-to-site communications security

Site and SQL Server backups

Backing up Configuration Manager

Restoring Configuration Manager

Recovering from a site server operating system crash

Recovering from a Configuration Manager functional crash

Using backup and restore to migrate to a new environment

Moving Configuration Manager to a new hardware

Building a new Configuration Manager environment

Summary

8. Troubleshooting

Troubleshooting network issues

Network configuration issues

Troubleshooting connectivity issues

Name resolution issues

Blocked or unresponsive ports

Timeout issues

Identifying network issues

Network issues affecting the site configuration

Network issues affecting the client installation

Issues with the Service Principal Name

Network issues affecting the software distribution

Network issues affecting site communications

Troubleshooting the data replication service

Troubleshooting console issues

Console logging

Verifying WMI permissions

Verifying DCOM permissions

Troubleshooting the client installation

Troubleshooting compliance settings

Troubleshooting application deployments

Troubleshooting software updates

Windows Server Update Services and Software Update Point

Troubleshooting SQL Server Reporting Services

Summary

Index

Mastering System Center Configuration Manager

Mastering System Center Configuration Manager

Copyright © 2014 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: December 2014

Production reference: 1191214

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78217-545-2

www.packtpub.com

Credits

Author

Vangel Krstevski

Reviewers

Deepak Agarwal

Roel van Bueren

Torsten Meringer

Stephen Carter

Commissioning Editor

Amarabha Banerjee

Acquisition Editor

Subho Gupta

Content Development Editor

Athira Laji

Technical Editors

Shubhangi Dhamgaye

Humera Shaikh

Copy Editors

Dipti Kapadia

Deepa Nambiar

Project Coordinator

Harshal Ved

Proofreaders

Simran Bhogal

Paul Hindle

Maria Gould

Ameesha Green

Indexer

Rekha Nair

Production Coordinator

Conidon Miranda

Cover Work

Conidon Miranda

About the Author

Vangel Krstevski is an IT engineer with 5 years of experience in engineering IT Systems based on Microsoft guidelines. He is a strong team player with an affinity for details. His strengths include excellent communication skills, hands-on experience with various Microsoft products, and the ability to manage conflicts and accomplish demands to the agreed standards and timelines. He is currently employed by Re-Aktiv, a software development and consultancy company from Skopje, Macedonia, which specializes in the area of electronic services and company public registry solutions. His main areas of expertise are server virtualization, hybrid cloud scenario design and implementation, and Business Continuity along with System Center. He has worked on many projects, both internal and commercial, as a consultant for Microsoft server-side platforms. He has already written a book titled Hyper-V Replica Essentials, Packt Publishing, which helps organizations to implement business continuity and disaster recovery strategies.

I would like to thank my family, friends, and colleagues for supporting me, especially my girlfriend, Monika, who stood by me and gave me support and motivation during the process of writing of this book.

About the Reviewers

Deepak Agarwal [Microsoft MVP] is a Microsoft Certified Professional who has been working professionally on Dynamics AX. He has worked with different versions of Axapta, such as AX 2009, AX 2012, R2, and R3. He has held a wide range of development, consulting, and leading roles while always maintaining the role of a business application developer. Although his strengths are rooted in X++ development, he is a highly regarded developer and has an extensive knowledge of the technical aspects of Dynamics AX development and customization.

He was awarded the title of Most Valuable Professional (MVP) on Dynamics AX in 2013 and 2014 by Microsoft. He has also worked on Microsoft Dynamics AX 2012 Reporting Cookbook, Packt Publishing, and is currently reviewing two more books, both for Packt Publishing.

Deepak shares his experience with Dynamics AX on his blog at http://theaxapta.blogspot.in/.

A big thanks to my dear friends Chetan Sharma and Chetan Tanwar for their motivation, support, and guidance.

Roel van Bueren works as the Chief Architect and Product Director for ROVABU Software BV. Roel specializes in software packaging using Windows Installer, OS Deployment (OSD), and Electronic Software Distribution (ESD) using Microsoft System Center Configuration Manager, Novell ZENworks Configuration Management, RES Automation Manager, and ENGL Imaging Toolkit. His latest projects involve Bundle Commander for Novell ZENworks Configuration Management and Setup Commander for Microsoft System Center Configuration Manager 2012, Microsoft Deployment Toolkit, and other ESD solutions, such as Dell KACE and RES Automation Manager.

Torsten Meringer is a ConfigMgr MVP since 2005 and is a self-employed senior consultant located in Germany. He started his own business in 1999 and primarily focusses on designing, migrating, deploying, training, automating, and troubleshooting Microsoft's deployment and management solutions, such as System Center Configuration Manager, System Center Orchestrator, and Microsoft Deployment Toolkit in small-scale to large-scale companies ranging from 500 to more than 200,000 clients. Torsten manages the German ConfigMgr blog, http://www.mssccmfaq.de, and holds various MCT, MCSA, MCSE, MCTS, and MCITP:EA certifications. He is also an author and often speaks at various Microsoft events.

Stephen Carter is a successful, independent IT consultant who specializes in infrastructure automation. He has over 20 years of experience in the IT industry and has been working with Microsoft's Configuration Management solutions since SMS 2003. He has designed, implemented, deployed, and developed Configuration Management infrastructures for a number of global financial institutions.

He is passionate about automation and has spent a large part of his career in streamlining and developing innovative solutions to assist his clients with simplifying their IT processes.

Originally from the UK, Stephen now lives in Australia with his wife and three children.

www.PacktPub.com

Support files, eBooks, discount offers, and more

For support files and downloads related to your book, please visit www.PacktPub.com.

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books.

Why subscribe?

Fully searchable across every book published by Packt

Copy and paste, print, and bookmark content

On demand and accessible via a web browser

Free access for Packt account holders

If you have an account with Packt at www.PacktPub.com, you can use this to access PacktLib today and view 9 entirely free books. Simply use your login credentials for immediate access.

Instant updates on new Packt books

Get notified! Find out when new books are published by following @PacktEnterprise on Twitter or the Packt Enterprise Facebook page.

Preface

Microsoft System Center Configuration Manager is a powerful System Management product that helps IT administrators with better asset management and organization by grouping them into logical containers. These logical containers allow you to make the deployment of applications easier, software and security updates, antimalware definitions, and so on. Configuration Manager assists you in operating system deployment, allowing you to deploy OS images to multiple target systems at the same time. It also empowers users to be more productive from anywhere on any device by implementing state-of-the-art mobile device management functionalities.

What this book covers

Chapter 1, Introduction to System Center Configuration Manager 2012 R2, is all about the initial setup of Configuration Manager 2012 R2. It shows you how to install and set up all the prerequisites and requirements. In the end, there is an explanation on System Center Configuration Manager sites and site hierarchy and all of the site features and functionalities.

Chapter 2, Assets and Compliance, is more about compliance settings and Endpoint Protection. Compliance settings, with knowledge and creativity, can give you feedback about the configuration and compliance of your Windows-based systems and mobile devices.

Chapter 3, The Software Library, explains the different ways in which you can deploy software and also explains how you can use System Center Configuration Manager to do this. It gives you an overview of what applications are and how to create them in Configuration Manager, how to make deployment types, and how to create different detection rules.

Chapter 4, Reporting in Configuration Manager, explains how SQL Server Reporting Services give you the opportunity to show the information contained in the Configuration manager database using SSRS reporting.

Chapter 5, Administration and Monitoring, describes the way in which the System Center Configuration Manager hierarchy is organized. Towards the end, it discusses all the aspects of client settings and how to use these settings to make an optimal configuration for your business needs.

Chapter 6, Cloud Integration, describes the benefits of a public cloud, specifically Windows Azure, and explains how you can use System Center Configuration Manager 2012 R2 to deliver application packages to your clients that run on different mobile device operating systems.

Chapter 7, Security and Backup, describes the infrastructure security for Configuration Manager and the delegation of administrative access. This chapter includes a detailed description of a new role-based administration model and an overview of the Configuration Manager controls and security accounts.

Chapter 8, Troubleshooting, presents the different aspects of how to troubleshoot issues related to the functionalities of Configuration Manager. It begins with common network-related issues and continues by explaining common Configuration Manager console issues.

What you need for this book

In order to be able to follow the guidelines in this book and implement the procedures explained in it, you will need the following software:

System Center Configuration Manager 2012 R2

Microsoft Windows Server 2012 R2

7 ZIP

Microsoft SQL Server Report Builder 2012

Windows Azure

Who this book is for

This book is excellent for IT administrators who want to improve their system and asset management. A fair understanding of the core elements and applications related to SCCM will be helpful.

Conventions

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: You can use the prerequisites checker tool that is provided with the System Center Configuration Manager 2012 R2 installation media, which is located in \SMSSETUP\BIN\x64\prereqchk.exe.

A block of code is set as follows:

mpcmdrun.exe –removedefinitions [All]

Any command-line input or output is written as follows:

SMSEP Setup Started.... Installing the SMSEP Unable to query registry key (SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Security Client), return (0x00000002) means EP client is NOT installed Installation was successful.

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: To view or edit the configuration items on a particular site, click on the Assets and Compliance section of the Configuration Manager console and select Compliance Settings.

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

Reader feedback

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.

To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title via the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded on our website, or added to any list of existing errata, under the Errata section of that title. Any existing errata can be viewed by selecting your title from http://www.packtpub.com/support.

Piracy

Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.

Please contact us at <[email protected]> with a link to the suspected pirated material.

We appreciate your help in protecting our authors, and our ability to bring you valuable content.

Questions

You can