Forums

Cannot access domain controllers with Right Click Tools

Thu, 17 Nov 2011 13:39:52 GMT

Hey guys, I find when I run the tasks in the Right Click Tools (like Machine Policy Retrieval and Eval), I get an access denied on domain controllers...even though I am logged in as domain administrator.

Any idea how to fix this?

Forums: Re: Cannot access domain controllers with Right Click Tools

Sun, 29 Jan 2012 14:43:38 GMT

Kitty, I am unable to duplicate your issue. Is this still a problem?

Forums: Re: PKI Requirements

Mon, 23 Jan 2012 15:54:22 GMT

vPro support and Native Mode are two completely unrelated and independant things in ConfigMgr. Both happen to have separate PKI requirements but this in no way implies that using one means you must use the other.

RE: Re: PKI Requirements

Mon, 23 Jan 2012 18:29:12 GMT

Thank You!

PKI Requirements

Mon, 23 Jan 2012 14:50:59 GMT

Hello -

We are looking at implementing PKI to assist and leverage the Intel VPro technology on our laptops and desktops. Currently, we are in mixed mode - if I implement PKI, do i need to to switch to Native mode. Or can I have mixed mode with PKI?

I have no internet facing clients to support.

Forums: Re: Secondary site or Primary site for DMZ

Thu, 19 Jan 2012 12:58:36 GMT

Hello togehter,

i am new here in the forum and search also for an solution to patch our servers in the dmz.

We have in the moment the following situation.

10 Windows Servers located in the DMZ, 5 are in an workgroup an the other servers are joined to the domain.

In our network we have an running SCCM environment with one SCCM-server and located primary site and also an WSUS server. We have 4 secondary sites for our substitaries.

What we want is to grab our DMZ-systems to the automatic patchmanagement but i am not really sure what is the best way.

What i have found is the follwoing;

first we want to install the SCCM-Clients manually and pen the ports 80/443 from the DMZ to the internal network, our security man said this isnt what he want.

next idea was we install an additinal SCCM-server to the DMZ but not sure which side we need and so not to open to many port. first think about an secondary site but found out that the clients in the DMZ then also need access to the MP in the lan is that correct?

Should we install an additional primary side in teh DMZ and open the prots for the communication between both primary sides? this is the port 445 (SMB9 and 1723 correct?

Sorry for my bad english.

I hope that someone can help me find an solution for my questions?

Thanks a lot

Regards

Thorsten

Secondary site or Primary site for DMZ

Fri, 13 Jan 2012 15:16:06 GMT

I have a SCCM setup on my domain called DOM1 in Mixed mode.

I want to manage my servers in DMZ1 / for updates /inventory

DMZ1 is a DMZ zone , the security guy doesn't want to open ports between DMZ1en DOM1 exept for only one server (server to server communication).
There is also DMZ2 with again some servers in workgroup or seperate domain

DOM1 and DMZ1 are untrusted, completely seperated domains.

Do I need to do this with primary site(s) in my DMZ1/DMZ2 Zone ?

    ---------------------
   |    SERVERsx    |
   |         ISA       |
    ----------------------

DMZ2
Internet
Firewall
---------------------------------------------------------
DMZ1

Regards

Forums: Re: Secondary site or Primary site for DMZ

Sat, 14 Jan 2012 14:54:13 GMT

Secondary sites are not for isolated networks; clients in the boundaries of seconary sites must still be able to communicate with the MP of the primary site. Therefore, DMZ scenarios are best addressed using a primary site.

KB2536089 Advanced Client Hotfix Errors

Thu, 05 Jan 2012 20:33:26 GMT

Got an issue. When trying to deploy this package, it seams to install fine but in the Advertisement Status it tells me that it has failed.

The Program was able to be executed but the system was restarted unexpectedly before the program could be completed or before status could be recorded. No installation status MIF was found afeter the System Restarted.

I know this is because the service gets restarted and the solution is to put in a MIF file Name as per the KB article. I have done this but it does not seam to work

From KB Article:
Additionally, to ensure accurate status
is reported back for the application of
the client hotfix, the MIF file
name must be specified in the "MIF file name"
field of the Reporting tab. For example,
if the .msp file is named:
"SCCM2007AC-KB891073-x86.msp"
you would enter:
"CMclient.SCCM2007AC-KB891073-x86.mif"
(without the quotes).

Because the application of this hotfix
on a client computer stops and restarts
the SMS Agent Host service, it cannot monitor
for an exit code from the update and must
rely on finding a matching status MIF
after the service is restarted.
If a matching MIF is not found, the
status will be reported to ConfigMgr as a failure
(1603) even though the update may have
completed successfully.

Anyone else have this issue?

Collection query to group computers with Adobe products installed

Wed, 28 Dec 2011 21:11:27 GMT

Hey guys, anyone have a catch-all query to create a collection of all computers with any Adobe product installed? I didnt see it on the master collection page.

RE: Collection query to group computers with Adobe products installed

Wed, 28 Dec 2011 21:14:03 GMT

Hey Kitty, it is on the page. You can find it here

QuickTricks – Configuration Manager query for Adobe Apps

and here is the full query

Select distinct

v_R_System_Valid.Netbios_Name0 AS "Netbios Name",

v_GS_INSTALLED_EXECUTABLE.ExecutableName0 AS "File Name",

v_GS_INSTALLED_EXECUTABLE.Product0 AS "File Description",

"File Version" = CASE when (v_GS_INSTALLED_EXECUTABLE.Product0 is NULL or v_GS_INSTALLED_EXECUTABLE.Product0 = '-1') then 'Unknown'

Else v_GS_INSTALLED_EXECUTABLE.Product0 End,

"File Size" = CASE when (v_GS_INSTALLED_EXECUTABLE.FileSize0 IS NULL or v_GS_INSTALLED_EXECUTABLE.FileSize0 = '-1') then 'Unknown'

Else v_GS_INSTALLED_EXECUTABLE.FileSize0 End,

"Modified Date" = CASE when (v_GS_INSTALLED_EXECUTABLE.TimeStamp is NULL ) then 'Unknown'

Else CAST(v_GS_INSTALLED_EXECUTABLE.TimeStamp as varchar)End,

"File Path" = CASE when (v_GS_INSTALLED_EXECUTABLE.InstalledFilePath0 IS NULL or v_GS_INSTALLED_EXECUTABLE. InstalledFilePath0= '-1') then 'Unknown'

Else v_GS_INSTALLED_EXECUTABLE. InstalledFilePath0 End

FROM v_GS_INSTALLED_EXECUTABLE

INNER JOIN v_R_System_Valid

on v_R_System_Valid.ResourceID = v_GS_INSTALLED_EXECUTABLE.ResourceID

INNER JOIN v_FullCollectionMembership

on v_R_System_Valid.ResourceID= v_FullCollectionMembership.ResourceID

Where Product0 like 'Adobe%'

and v_FullCollectionMembership.CollectionID = @Collection

order by v_GS_INSTALLED_EXECUTABLE.Product0, 'File Version'

And for anyone visiting for the first time, see the master collection at SCCM Collection Queries (Master)

Is it possible to create / retrieve Configmgr maintenance windows in PowerShell?

Tue, 20 Dec 2011 14:14:32 GMT

I actually need to retrieve and create in batch if possible. Are there any ready-made scripts you know of? My google search is coming up empty.

Forums: Re: Is it possible to create / retrieve Configmgr maintenance windows in PowerShell?

Tue, 27 Dec 2011 17:56:48 GMT

Done Pete!

Forums: Re: Is it possible to create / retrieve Configmgr maintenance windows in PowerShell?

Tue, 20 Dec 2011 14:20:54 GMT

Tommy, would you please add links to these on your "Master List of System Center PowerShell" ?

RE: Is it possible to create / retrieve Configmgr maintenance windows in PowerShell?

Tue, 20 Dec 2011 14:20:04 GMT

Harashukugrl,

It may be because maintenance windows are sometimes referred to as service windows. Here are two great resources that should give you an excellent start. You'll need to do a bit of work to

Create Maintenance Windows - PowerShell: ConfigMgr 2007 – Create Maintenance Window
Retrieve Maintenance Windows - SCCM 2007 : Get Service Window with PowerShell / WMI

More about maintenance windows

maintenance windowscan overlap building a larger total amount for running programs and reboots.
- The total time is not a sum of both windows but will start at the earliest window start time and end at the latest window expiration time.
When they are configured you can set them to reoccur, giving them a start and stop date if needed.
You can set them for specific days, you can set them for just a single day, but then when it expires your clients will not run anything in the future until the window is deleted.
There is an option to apply maintenance windows only to Operating System Deployments, this is set when you configure the maintenance window.
A single maintenance windows should not exceed 24 hours.

Forums: Re: Command Shell in Configuration Manager 2012?

Wed, 14 Dec 2011 11:54:20 GMT

So as Marco says, get comfortable with WMI in PoSh and maybe we'll see a refresh of the community ConfigMgr PoSh extensions at http://www.snowland.se/sccm-posh/

Command Shell in Configuration Manager 2012?

Mon, 12 Dec 2011 07:03:02 GMT

Is there a PowerShell command shell coming for Configuration Manager 2012? It seems the other System Center products have this, but did not see one in the Configmgr 2012 beta.

PS - Glad the site is back and healthy!

Forums: Re: Command Shell in Configuration Manager 2012?

Tue, 13 Dec 2011 17:40:43 GMT

There won't be any "PowerShell extensions" available with the base ConfMgr 2012 product that will be supported by Microsoft. I understand the ConfigMgr 2012 SDK will be something provided in the future and may provide some guidance on what to expect possibly in the future.

So... WMI is your best option for the foreseeable future.

Forums: Re: Command Shell in Configuration Manager 2012?

Mon, 12 Dec 2011 19:06:01 GMT

And Trevor Sullivan has the namespaces in a slightly more manageable format (Excel spreadsheet) with great description fields - http://trevorsullivan.net/2011/08/02/configmgr-2012-beta-2-wmi-namespace-documentation/

Forums: Re: Command Shell in Configuration Manager 2012?

Mon, 12 Dec 2011 18:18:23 GMT

You can also get the replay download from event sponsor BDNA at http://info.bdna.com/20110713-Replay-SCCM-GURU-Wally-Mead-reg1.html

RE: Re: Mix of SCCM Client versions

Mon, 12 Dec 2011 18:15:07 GMT

Could the client have *somehow* fallen outside the defined boundaries? Or, the endpoint may have other client issues that you weren't aware of until now, keeping the new client from installing successfully.