...System Center Configuration Manager 2007 is a multitalented animal for distributing software, and with the branch distribution point option you may not need a secondary site server in branch offices. Microsoft’s System Center Configuration Manager 2007 (ConfigMgr) introduces many site server roles. In this article, we look at the branch distribution point.
 

Click Download to read the full article...

In this article

• Extracting the MSI
• How to Create the Transform
• Coexistence of Reader and Acrobat
• ConfigMgr Command Line
• Caveats and Issues

Obtaining and Extracting the MSI

You have to begin by filling out a form to tell Adobe how many copies you intend to install, etc. The form tells you approval will come within 3 days. We received an approval e-mail immediately. The file you will download is actually an executable. You will need to extract the MSI. You can find instructions for extracting the Adobe Reader 9 installer file (msi) at this URL: http://kb2.adobe.com/cps/404/kb404146.html

Abbreviated Instructions for extracting the MSI

1. Download the AdbeRdr9x_en_US.exe from the link in the confirmation email you receive after filling out the distribution agreement and save the file to your desktop.
2. Choose Start > Run.
3. In the Open text box, type: "%UserProfile%\Desktop\AdbeRdr9x_en_US.exe" -nos_ne.
4. Click OK to start decompressing the file.
5. When the Adobe Reader 9.x Setup screen clears, browse to the following location
   %UserProfile%\Local Settings\Application Data\Adobe\Reader 9.0\Setup Files

How to create the transform

You need to download the Adobe 9 Customization Wizard for building a transform (mst) file. You can download at this URL:

http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993

It works with the following Adobe products:

• Obtaining and Extracting the MSI
• Adobe Acrobat 9 Pro Extended
• Adobe Acrobat 9 Pro
• Adobe Acrobat 9 Standard
• Adobe Reader 9

And here’s some of what you can do with the transform

• Optimize the behavior of the installer by including silent installation, preserialization, multilingual, and custom setup choices
• Remove previous versions of Acrobat and Reader
• Suppress the EULA, registration prompts, and the Getting Started window
• Customize key application preferences — turn off automatic updates, add and set default job options, and customize collaboration and security settings
• Remove shortcuts from the desktop and the Start menu
• Edit each Adobe Acrobat application's registry and installer tables
• Customize file attachment handling within PDF files, including specifying which file types you want to block
• Add or edit files that will be installed, including customized JavaScript or plug-ins
• Preconfigure Acrobat Connect and disable it
• Preconfigure and lock Enhanced Security settings
• Deploy custom Portfolio navigators
• Add or remove custom redaction code sets

Coexistence of Acrobat and Reader

You can set whatever options suit your organization, but if you intend to install Adobe Acrobat 9 (Standard or Pro) on systems, do one of two things.

1. Do not install Adobe Reader on these systems or

2. On the Installation Options screen in the Customization Wizard, choose the ‘Installer will decide which product will be the default’ option. More on this in the ‘Caveats and Issue' section below

ConfigMgr Command Line

Here is the command line we used in our ConfigMgr environment to deploy Adobe Reader with the customizations we made in the transform (mst). Replace mytransform.mst with the name of your transform file.

msiexec.exe /q ALLUSERS=2 /m MSIHPSJR /i "AcroRead.msi" TRANSFORMS=mytransform.mst

Caveats and Issues

We actually ran into a problems when we failed to follow the advice in the “Coexistence of Acrobat and Reader” section mentioned above. We had issues when we tried to choose the behavior and it broke functionality for reading PDFs in a web browser. You can read about this issue on the Adobe.com support forums at http://forums.adobe.com/thread/448355

I hope you find this information helpful. Please post your questions to the Configuration Manager support forum on this site.

As individuals we have been involved in the community dating back to as early as the year 2000, well before the ‘System Center’ moniker even existed and over that time we have seen and been a part of the evolution of these products. At the same time, we have watched the organic grown of the community that administers and supports these technologies and we noticed that a lot of the content was dispersed and scattered in various blogs and product specific community sites. From our view , community is about helping people find answers. Our goal in building SystemCenterCentral.com is to help consolidate all of this disparate content and make it easier to find the information that you are looking for.. While there are efforts to deliver this for all System Center product s today, no one site provides authoritative coverage of the entire suite today. With this goal in mind, we are hard at work developing a site with a mix of features you won’t find anywhere else. 

SystemCenterCentral.com is a community site that is funded through sponsors, typically independent software vendors that are interested in making their offerings known to the community. Microsoft, Quest, Bridgeways and Secure Vantage Technologies are the founding sponsors of SystemCenterCentral.com, the types of companies that you see in the exhibit hall at industry events like the Microsoft Management Summit (MMS) and TechEd. SystemCenterCentral.com is operated as a not-for-profit venture. None of the founders or contributors are paid a salary or compensated monetarily in any way for their time or contributions. Instead, the money raised through sponsorships is used to pay for site development and hosting and to support user groups within the community.

In our view, community is about people, not web addresses. We encourage everyone in the System Center community to become a registered user at SystemCenterCentral.com, meet other members of the System Center Community and feel a part of a community that supports one another. If you are already a member of an existing community, you too are welcome. You will not be asked to choose one community over another as our belief is that there will always be room for everyone. We simply encourage you to join in the discussion and become a part of the growing community of IT professionals around the world helping one another make the most of their System Center investment.

Welcome to SystemCenterCentral.com. We look forward to your participation, feedback and contributions! 

To get this feature off to a winning start, we had a visit with newly awarded ConfigMgr 2007 MVP and SCCM Unleashed author Jason Sandys

In this issue, Jason sheds light on some oft asked questions in Configuration Manager 2007, as well as what's for OSD in R2, including:

• Best Practices Recommendations for Patch Management
• Tips for minimizing clutter and the potential for negative impact.
• What’s new in OSD in SCCM 2007 R2
• Why WDS Users should make the move 

Many thanks to Jason for sharing his time and expertise!

In this post, I'll provide an overview of DCM functionality, some of the business drivers for it's use, as well as links to 3rd party resources with offerings to augment out-of-the-box functionality in DCM to give you a running start at DCM in your own environment.

What is Desired Configuration Management (DCM)?

DCM is a feature in SCCM 2007 that will provides a framework for assisting organizations in both defining and enforcing corporate policies and standards for system configurations, whether related to the operating system or an application installed on the system. ?In this article, I'm going to do a 50,000 foot flyover of the DCM along and provide pointers to some great resources

First, let me say that DCM in Configuration Manager 2007 is not the DCM you may remember from SMS 2003 fame (or infamy, depending on who you ask). The DCM feature of SCCM 2007 is a complete retooling of the feature, with authoring and scheduling features integrated into the Console, while leveraging the new the many improvements in Configuration Manager 2007 for improved scalability and performance. The new platform incorporates model-based design leveraging Service Modeling Language (SML) (a component of Microsoft's Dynamic Systems Initiative) which makes the features we're about to discuss possible.

Some of the key scenarios that drove the features Microsoft delivered in the final release of DCM include:

• Regulatory Compliance - Desired Configuration Manager was as a tool for demonstrating regulatory compliance (e.g. - Sarbanes-Oxley, HIPAA, FISMA, etc) in system configurations. The key at the end of the day is not only deploying a compliant standard system configuration, but being able to periodically prove adherence to these policies.

• Pre and post change configuration - Verify that no unplanned changes took place during the implementation of a planned change.

• Monitoring for "drift" - Verify that new systems are built in accordance to the planned role in your infrastructure, and monitoring for human error and misconfiguration in day-to-day administration. In short, ensuring corporate policies are implemented in base machine builds and maintained over time.

• Streamline Support - Incorporating DCM reporting into the troubleshooting process to drive down time to resolution and overall support costs.

The bottom line - DCM monitors your systems actual configuration against a "desired configuration" model and identifies policies that have drifted outside this policy.

DCM Components

To most effectively implement desired configuration management, it is important to familiarize yourself with 3 key concepts: ?Configuration Items, Configuration Baselines, and Configuration Packs.

The smallest unit of measure in the DCM model is the Configuration Item (CI). Configuration Items represent a desired object or setting or value on a server or within an application. Configuration items can include registry values, objects on the file system (files, folders) and attributes (firewall settings, NTFS permissions), as well data retrieved via scripts. The Configuration Items fall into one of the following categories:

• Application CI - Settings within an application like MS Word, Exchange, or SQL Server.

• OS CI - Representing a specific operating system object or setting.

• General CI - General settings related to corporate policies like corporate security policy, Sarbanes-Oxley, etc.

These configuration items are reusable, and can be grouped into multiple, logical collections of settings known as a Configuration Baselines, which represent your base unit of management in DCM. Within the configuration baseline, you can define mandatory, optional and prohibited configuration items.?

Configuration Baselines will generally be constructed to map to machine roles (a type or class of system), such as Domain Controller, Exchange 2003 Server, SQL Database Server. As one can imagine, creating all the configuration items for configuration baseline for something like Exchange could take a lot of time and effort.? This is where Configuration Packs come in. Configuration Packs are pre-defined configuration baselines (templates so to speak) created by Microsoft and 3^rd parties representing best practice configuration for common OS and server applications. Configuration packs are designed to be used as a starting point for your own corporate baseline, and then modified to meet your organizations requirements.

Where can I get Configuration Packs?

Currently available Configuration Packs can be found in the System Center Pack Catalog. Here you will find dozens of templates from Microsoft and MS partners, including baselines for Windows 2003, several popular server applications, including templates targeted to various regulatory standards like Sarbanes Oxley, GLBA, FISMA, and EUDPD. MSIT has also assisted in delivering 3 levels of configuration packs (basic, intermediate and advanced) for several common server roles including AD, File and Print, DHCP, DNS, WINS.

Reporting and Enforcement

Configuration Manager comes with a pretty good reporting environment out of the box, and by building query-based collections based on DCM compliance results; you can then leverage the software deployment features of SCCM 2007 to target programs to the collection. The next step in automating remediation is planned for a future release.

Managing the Configuration Pack Lifecycle

The pace of change is fast, and corporate policies (and the configuration baselines defined to support them) evolve over time. This brings about several key challenges in managing change within your configuration management strategy, such as:

• So how can I manage and document the changes to my Configuration Baselines over time?

• How can I test the effect of a new configuration baseline BEFORE I deploy to my production environment?

• How can I manage rollback to a previous version in the event of a mistake?

• How can I effectively report on my organizations compliance?

3^rd Party Resources

To support these processes, both Silect Software and SecureVantage are delivering solutions for Configuration Pack lifecycle management and DCM compliance reporting.

• The Silect offering is called CP Studio, and is similar to their MP Studio offering for Opsmgr 2007 in that CP Studio offers versioning, change and lifecycle management for your Configuration Packs.

• The SecureVantage offering includes Desired Configuration Compliance Reporting amongst other things (more on this when I'm more familiar).

Next Steps

To get started with DCM, you can download a copy of SCCM 2007 from the product homepage on the Microsoft site at? http://www.microsoft.com/systemcenter/configmgr/default.mspx

For additional information on the 3^rd party offerings for DCM mentioned in this article:

• For more info on DCM Studio 2008, contact Silect Software at info@silect.com for a free trial or visit http://www.silect.com/.

• For information on SecureVantage Reporting offerings for DCM in SCCM 2007, contact them at info@securevantage.com.

Your comments and feedback are welcome via comments on this post..

There have been three major iterations of SMS. The 1.x versions of the product defined the scope of control of the management server (the site) in terms of the NT domain that was being managed. Since the 2.x versions, that site paradigm has switched to a group of subnets that will be managed together. Since SMS 2003, the site could also be defined as one or more Active Directory sites. The most frequently used feature is inventory management, which provides both hardware and software inventory across a business enterprise.

The major difference between the 2.x product and SMS 2003 is the introduction of the Advanced Client. The Advanced Client communicates with a more scalable management infrastructure, namely the Management Point. A Management Point (MP) can manage up to twenty five thousand Advanced Clients.

The Advanced Client was introduced to provide a solution to the problem that a managed laptop might connect to a corporate network from multiple locations and should not always download content from the same place within the enterprise (though it should always receive policy from its own site). When an Advanced Client is within another location (SMS Site), it may use a local distribution point to download or run a program which can conserve bandwidth across a WAN.

Microsoft announced the next generation of the product, "V4" (formally named System Center Configuration Manager 2007) at the Microsoft Management Summit in April 2005. The product was released to manufacturing in August of 2007 and was available for general release in November of 2007. A free evaluation edition of System Center Configuration Manager 2007 is available on the Microsoft download center.