System Center 2007 Installation Guide –

May 8, 2013
By

Page 1 of 12

Rev. 2

-Harwelik -Harwelik

System Center Configuration Manager

(SCCM) 2007 SP1 Guide

In this guide

    Installing the ConfigMgr client

    Installing the ConfigMgr admin console

    Creating collections, packages, programs, and advertisements

    Expediting Package Deployment

    Additional Capabilities

    Helpful tools

    ConfigMgr admin console notes

    Troubleshooting

 

Installing the ConfigMgr client

GPO

Attach the GPO ‘UMNAD – Configmgr SP1 Client Health Check’ to the desired OU to install the

ConfigMgr client.

To do this:

Open the GPMC, right-click on an OU containing your desired workstations and choose

LLiinnkk aann EExxiissttiinngg GGPPO…O… anandd ddoouubblele cclilicckk oonn UMUMNNADAD –– CCoonnfifiggmmggrr SSP1P1 CClliieenntt HeHeaalltthh

Check.

 

The script is a client health script that will install/replace the client if it is missing or out of date, as well as do health checks to make sure the client is functioning correctly on the operating system.

 

NOTE: Make sure that the other group policies which install the SMS 2003 client do not apply to the OU that this GPO is applied to. If this is not done, the scripts will continually try of install over each other.

 

-‘Prerequisites for client install’ (below) and ‘Troubleshooting’ (p. 10) provide additional

information regarding the ConfigMgr client installation process.

 

 

Page 2 of 12

 

Prerequisites for client install

Be aware that these prerequisites can be installed by the ConfigMgr client install from the script, but this may require extra reboots of the computer before the client is installed.

 

    BITS 2.5 if operating system is Windows XP

o WindowsXP-KB923845-x86-ENU.exe

    Microsoft Core XML Services (MSXML) version 6.0.3883.0

o msxml6.msi

    Install Microsoft Windows Installer version 3.1.4000.2435

o WindowsInstaller-KB893803-v2-x86.exe

    Microsoft Windows Update Agent version 7.0.6000.363

o WindowsUpdateAgent30-x86.exe

 

Installing the ConfigMgr admin console

The ConfigMgr admin console package has been created and advertised in the ConfigMgr site. It is advertised to all <deptname>-AdminComputers. To get the advertisement add the desired computer to your <deptname>-AdminComputers group.

 

If you are just joining the centrally offered Configuration Manager 2007 implementation, complete the following:

 

Creating an admin computer group in AD

 

1. Create a group in your Active Directory OU following department naming conventions called DeptName-AdminComputers. In this group place all the computer accounts you want to be able to install the ConfigMgr Admin Console.

 

2. Email umnad@umn.edu with the name of the group once it has been created.  One of the UMNAD team members will add your group and you will receive the advertisement in a matter of time.

 

NOTE: The SMS admin console and the ConfigMgr admin console  CANNOT both be installed on the same computer.  To install the ConfigMgr console on a computer that has the old SMS console, you will have to uninstall the old SMS console first.

 

NOTE: If you previously joined SMS there is no need to create a group, your current group has been given rights. This will not cause a conflict if you run both consoles on different computer.

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 3 of 12

 

Prerequisites for ConfigMgr admin console

 

Ports

Please  note that  nothi ng needs to be done un l ess outbound traffic is being regu lated by the f i rewal l. Secure Hypertext Transfer Protocol {HTIPS)

TCP 443 — > umnad-sccm-ebl

 

H ypertext Transfer Protocol { HTIP) TCP 80– > umnad-sccm-ebl

RPC Endpoint  Mapper/RPC

 

TCP 135– > umnad-sccm-ebl

 

UDP 135 — > umnad-sccm-ebl

 

H ypertext Transfer Protocol { HTIP) TCP 80 – – > i nternet

 

****Use the fol lowing ports on ly if  perm itti ng remote control of clients**** These  ports  must  be opened on the  client to be remotely controlled. Configuration Manager Console — > Client

 

 

Description

   

UDP

 

TCP

Remote Control (control)   2701 2701
Remote Control (data)   2702 2702
 

Remote Assistance (RDP and RTC)

     

3389

 

Rev.2

-Harwelik  umnad@umn.edu

 

 

Page 4 of 12

 

Software

Software update KB913538

 

Software update KB932303

 

MMC version 3

 

.NET framework 2

 

Windows Remote Management (WinRM v1.1) KB936059

 

Creating collections, packages, programs, and advertisements

You can host your source packages on your AD department share or member server. You need to limit NTFS permissions to only your OU Admins and the computer group “ConfigMgr Management Points” (read only). This allows the ConfigMgr Management Point to copy your package to the distribution point.

 

All collections, packages, and advertisements need to follow department naming conventions: e.g. (OIT-Firefox2).

 

Once the ConfigMgr client has been deployed on your computers, they should appear within the ConfigMgr Administrator Console under Collections>DeptName. It is a best practice to create separate collections such as DeptName-Firefox or DeptName-RetailPCs and only include the computers that will receive that software in the collection in the Membership Rules of the collection which can be accessed by right-clicking on a collection and choosing Properties.

 

You can deploy advertisements to your root department collection if you want all computers to receive the advertisement, including any new or reinstalled computers that have the ConfigMgr client installed in the future.

 

The best way to build collections is to create a query rule within the Membership Rule tab based on Active Directory (AD) computer group membership or AD Organizational Unit (OU) so collection membership can be automatically updated and managed within AD instead of having to manually add and remove computers from your collections within the SMS Admin console. You can also create a direct membership rule and have multiple membership rules and types for a collection.

 

Creating Collections

To create a collection in the SMS Administrator Console, right click on <yourDeptName> collection under Computer Management and choose New>Collection. Type in the desired name (e.g. DeptName- Oracle). Click on the Membership Rule tab, and then click on the query cylinder icon. Name your query

Rev. 2

-Harwelik -Harwelik

 

 

Page 5 of 12

 

with your department name prefix, click on Edit Query Statement… Click on the Criteria tab then click

on the yellow star icon to the far right of Criteria: Leave Criterion type: to Simple value then click on the Select… button to the far left of Where: For Attribute class:, choose System Resource then for Attribute: choose System OU Name or System Group Name, then click OK. Leave Operator: at is equal to, then click on the Values… button to the far right of Value: and choose the correct OU or AD computer group (they can also be manually entered), then click OK three times which will close Criterion Properties and your query statement properties windows. Within Query Rule Properties, select “Limit to collection:” click on the Browse… button to the far right of Limit to collection: Choose your root department collection; then click OK twice to close Query Rule and collection Properties. It is also possible to create more complex queries for collections such as computers that only meet certain criteria such as a specific amount of free space, memory, etc.

 

To create a direct membership within the Membership Rules tab of your collection, click on the computer icon to the far left of Membership rules which will launch the Direct Membership Rule Wizard. Click Next and choose System Resource as the Resource class and choose Name for the Attribute name:. For value, enter % and click Next. Click Browse and limit the collection search to your root department collection, and click next. Select which computers you want to include and click Next. The resources should appear, then click Finish and OK to close the Collection Properties windows.

To view your computers immediately within your new collection based the AD computer group, OU, or direct membership you specified in the above steps, and to verify that the query or direct membership was successfully created, right-click on your new collection and under All Tasks, choose Update the Collection membership. If you do not see any computers appear after updating the collection membership, please verify you followed the above steps correctly and that the computer object is a member of the AD computer group or is located in the OU you specified. Collections are automatically updated every thirty minutes and top level collections are updated every hour. For further assistance, please contact umnad@umn.edu.

Verify that the computers in your collection show up on the right side of the ConfigMgr console with the

following info: UMN site code, Client: Yes, Assigned:Yes, Client Type: Advanced, Obsolete: No, Active: Yes. If this info doesn’t appear, you will not be able to successfully deploy advertisements to the computer.

 

Inactive clients should be resolved by the client health script that is attached through the GPO. This checks the health of the client and reinstalls, starts the service, and checks overall health of the client. To fix the inactive clients manually, you may need to reinstall the SMS client on the workstations, verify that the UMN site code is listed, and manually Discover the ConfigMgr site under the Advanced tab of the Configuration Manager control panel (this a option to discover will not be available until after the SMS 2003 site has been sunset due to boundary conflicts that would arise).

 

Creating and Securing Packages

Once your collection is setup, you can create a new package by right-clicking on Packages, located under the Software Distribution node, in the ConfigMgr Console and choosing New>Package. Follow the New Package Wizard and supply at least a name (e.g. DeptName-Thunderbird). Set the source directory to

the Network path (UNC name) in the source directory (e.g. \\dept-

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 6 of 12

 

servername\software$\Mozilla\Thunderbird) and click OK. Again, you must allow read access to your source package directory shares to the computer group: “ConfigMgr Management Points”. This allows the ConfigMgr server to copy your package to the distribution point. Leave Always obtain files from source directory selected. Complete the rest of the wizard.

 

Expand your new package and right click on the Distribution Points directory and choose New Distribution Points which should launch the New Distribution Points Wizard. Click next and check The correct Distribution Point (DP), if this package is available for both Internet Based clients and domain base send the package to UMNAD-SCCM-IBS as well as your local DP, then click Finish. Your package will then be copied to the DP. Any time you change or update a package or program, you need to right click on Distribution Points and choose All Tasks> Update Distribution Points so the latest version is copied to the DP.

 

Remember to add access to other ConfigMgr Admins you may have in your department so they can see and deploy your new package. Right click on your new package and choose Properties . Under the Security tab, click on the yellow star to the far right of Instance security rights: and choose their AD\username. Give them at least read permissions and click OK.

 

For ConfigMgr packages containing copyrighted software or scripts that may contain passwords, you are required to delete the default Users group for each package under the Access Accounts directory within your package and create a new Windows User Access Account with the user name: AD\Domain Computers or your department computer group (set Account type to group).

 

After this change is made, or when you update the source files, you need to update the distribution point within the ConfigMgr console by right-clicking on the Distribution Points directory under the package folder and choose Update Distribution Points. Failure to modify the above rights will allow all Active Directory users (Authenticated Users) to copy and install your software and view scripts from the distribution point share located on the DP server by default. Sophisticated users can obtain share names from ccm logs on local workstations.  With the current permission settings in order to allow advertising of a task sequence read permission has been given to packages in ConfigMgr.  We are in the process of finding a resolution for that issue.

 

Creating Programs and Advertisements

You now need to create a Program. Expand your new package and right click on Programs and choose New>Program. Type in the name (e.g. DeptName-Thunderbird2). Under Command line: click on the Browse… button and choose your .exe or .msi file that should appear that is located in your UNC source directory you specified when your created the package. Add any command line switches such as /q to silently deploy. Click on the Environment tab and choose Run with administrative rights. Check Allow users to interact with this program if the .msi or .exe can’t be deployed silently. This setting is somewhat risky since users could potentially cancel during the install process, but using the /qb!- will

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 7 of 12

 

remove the cancel option on a msi install. Leave Drive mode to Runs with UNC name. Program can run: Only when a user is logged on is usually the most commonly used setting. Click Ok.

For a list of common msiexec command line switches used when creating a program, visit

http://msdn2.microsoft.com/en-us/library/aa367988.aspx or perform a Google search on msiexec. The most common install method for deploying .msi’s which is entered in the Command Line field of a program is: “msiexec /i application.msi /qn”. The previous command will install the program silently and not restart the system. Remember that the command line is case sensitive for your programs and have to match the name exactly, otherwise your advertisement will fail. The following file types can be deployed with Configuration Manager: .exe, .bat, .vbs, etc.

 

To deploy your program, right click on the new collection you created containing only computers that you want to deploy to and choose Distribute > Software which will launch the Distribute Package Wizard. Follow the wizard to success distribute your package.

 

Creating Advertisements

Go to the Advertisements folder under Software Distribution, right-click it and select New > Advertisement; this will launch the New Advertisement Wizard. Make sure that the advertisement follows your department naming convention. Follow the wizard to successfully create an advertisement. You can check your advertisement’s status under System Status within the ConfigMgr Console.

It is highly recommended that you extensively test program deployments to test computers before you deploy to production computers in use to make sure there are no conflicts with existing software or configurations. It is possible to uninstall a program previously installed by SMS using the msiexec /x command and referencing the .msi or .exe.

 

Expediting the Package Deployment Process Remotely, Monitoring

Status

To run your advertisement on a specific client within a few minutes, click on the Initiate Action button after selecting the Machine Policy Retrieval & Evaluation Cycle action within the Configuration Manager Properties (located in control panel > Configuration Manager) click OK. Initiating ConfigMgr actions can also be done remotely via WMI, which is very useful for lab environments. Download and install the following third-party addition: Rick Houchins SCCM Right Click Tools.  After installing, you will see the enhancements to your right-click menu with additional options when you right click on collections or clients (prefaced with the site code: UMN). Choosing {sitecode} Client Actions> Machine Policy Evaluation and Update Cycle on an entire collection is the same as initiating the Machine Policy Retrieval & Evaluation Cycle. The remote administration firewall exception is necessary for clients to use this tool, see https://www1.umn.edu/umnad/oua/guides/remote_administration.html. Without initiating the above action, the package is usually deployed within the hour to clients. The user will be prompted when the program will be installed within 5 minutes for mandatory advertisements, if you have left alerts enabled.

You can monitor advertisement and package status within the SMS console within the System Status directory which will show any successes or failures and will show a timestamp of the last package update.

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 8 of 12

 

Occasionally, you will need to re-run the advertisement based on AdvertisementID (an option also included with this tool) if advertisements do not run within a few minutes after initiating a remote machine refresh. After obtaining the AdvertisementID ( this can be obtained by going to the advertisement and scrolling to the right until you reach the advertisement ID column) , right-click on a collection you are deploying to, and choose {sitecode} Collection Tools>ReRun Advertisements.  Enter the Advertisement ID in the prompt without quotes and click OK.

 

Additional Capabilities

Utilize resource explorer to view and export reports such as programs and updates listed in

Add/Remove Programs, serial number, OS, IP, MAC addresses, memory, processor type, etc.

You can access this info in the SMS admin console by right-clicking on a client and chooseStart>Resource

Explorer

Utilize hardware history to develop resource usage trends for SMS clients such as free space on logical drives.

 

Queries

If you need to obtain info for multiple clients for inventory/reporting purposes and export the results as

a .txt or .csv file, you can create customized queries, one of the most powerful features available in SMS, by right-clicking on the Queries folder and choosing New Query. Please append your department extension the beginning of the query name.

Object type should be left to System Resource. Under the General tab, limit your collection to your root collection or another collection containing clients. Click on Edit Query Statement… In the General tab, click on the yellow star to the far right of Results: Choose an attribute by clicking on the Select… button. Under the Attribute class: drop down, choose fields you want to display for the query results such as Computer System and Name under the Attribute: drop down menu, and click OK. Choose a sort order if desired, and click OK. The class and attribute should appear under the Results:. Add more fields classes and attributes if you like such as Operating System and Total Visible Memory Size. Other useful attributes/classes you may want to display: System Enclosure and Serial Number, Disk Drives and Size (Mbytes), Processor and Name .

SMS uses WQL to create queries, which is a subset of the SQL language. If you want to narrow down your query results, click on the Criteria tab in the Query Statement Properties, then click on the yellow star. Leave your Criterion type to Simple value unless you want to be prompted to enter values when the query is ran. Click on the Select… button, and if you want to include physical memory for example, choose Operating System for the Attribute class and Total Visible Memory Size for the Attribute, and click OK. Under the Operator drop down menu, choose an option such as is greater than or equal to, then specify a value in Megabytes, then click OK. The criteria you specified should now appear under Criteria:, click OK twice. You can now run the query from the SMS Administrator console (under the Queries directory) by right-clicking on the query you created, and choosing Run Query… You should then see the query results on the right side of your screen. You can export these results by right-clicking on your query and choosing Export List… Import the exported list into a program such as Excel to make the export more readable.

If desired, you can create a complex query to only display SMS clients with a specific version of Acrobat installed, at least 1GB of memory, and are running XP by adding multiple criteria and using and statements between each specified criteria. Only clients matching the criteria you specify will be

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 9 of 12

 

included in the query results or collection membership (if configured in a collection membership rule), and will be updated on a regular basis automatically for collection memberships.

You can also create and execute WMI queries against the SMS server and SQL database from a .vbs file.

SMS clients and servers depend on WMI and use it constantly to obtain hardware and advertisement info, and display data in the SMS admin console and more. Without using SMS, you can still use WMI queries to obtain hardware info on your clients, but one of many benefits of ConfigMgr is that your clients don’t need to be online to obtain info when you need it.

 

Helpful tools

 

Configuration Manager 2007 Toolkit

 

Rick Houchins SCCM Right Click Tools

 

UMNAD SMS Admin Documentation – requires logon, this material will be integrated into the ConfigMgr documentation in the future.

 

UMNAD ConfigMgr Website – this is a new offering that will be a source of information pertaining to the centrally offered implementation of Configuration Manager 2007.

 

ConfigMgr admin console notes

    When creating new collections create them below your already created collection.

    If you run into issues that may be rights related, please take a screenshot of the error and send to  umnad@umn.edu.

    There are some security boundaries on features that are not yet available, such as NAP (Network Access Protection) and Software Updates.

    Please direct any questions or comments to  umnad@umn.edu.

    The ConfigMgr Console unattended install has not been tested on 64bit OS, the install for the console on 64bit Windows OS is in the works and will be released at a later date.

    In order to successfully create a package for ConfigMgr you will need to grant read access to your source files to the computer UMNAD-SCCM-EB1.  If these source files are on the umn-spd$ share, the access has already been given.

    NOTE: In order to deploy packages until the SMS 2003 site is sunset, you must select to run or download from remote Distribution Point when creating advertisements.

 

Rev. 2

-Harwelik -Harwelik

 

 

Page 10 of 12

 

Troubleshooting

Most troubleshooting that  will be done for the client or admin console will be done by reviewing log

fi les.  You will find that Trace32 from the Configuration Manager 2007 Toolkit will be an invaluable tool.

 

Client install

The initial install of the client will place a log file in the root of the C drive called ConfigMgr.log,review this log to make sure it called ccmsetup.exe.

 

After reviewing that log the other log files you will need to review  are in

 

C:\WINDOWS\system32\ccmsetup.

 

Client

Your biggest help the troubleshooting a client with by the log files listed below. This list was taken and modified from:

http://technet.microsoft.com/en-us/library/bb892800.aspx

 

Cli ent Log Flies

 

The Configuration Manager 2007 client  logs are located in one of the following locations:

 

•  The client  log files are located in the %Windir%\System32\CCM\Logs folder or the

%Windir%\SysWOW64\CCM\Logs.

 

The following table lists and describes the client log files.

 

log File Na me                                                           Description

 

CAS                                                                              Content Access service. Maintains the local package  cache.

 

CcmExec.log                                                                Records activities of the client and the SMS Agent Host service.

 

CertificateMaintenance.log                                        Maintains certificates for Active Directory directory service and management points.

 

ClientiDManagerStartup.log                                      Creates and maintains the client GUID. Client ocation.log                                                       Site assignment tasks.

 

Rev. 2

-Harwelik  umnad@umn.edu

 

 

Page 11 of 12

 

ContentTransferManager.log Schedules the Background Intelligent Transfer Service (BITS) or the Server Message Block (SMB) to download or to access SMS packages.
DataTransferService.log Records all BITS communication for policy or package access.
Execmgr.log Records advertisements that run.
FileBITS.log Records all SMB package access tasks.
Fsinvprovider.log (renamed to FileSystemFile.log in all SMS 2003 Service Packs) Windows Management Instrumentation (WMI) provider for software inventory and file collection.
InventoryAgent.log Creates discovery data records (DDRs) and hardware and software inventory records.
LocationServices.log Finds management points and distribution points.
Mifprovider.log The WMI provider for .MIF files.
Mtrmgr.log Monitors all software metering processes.
PolicyAgent.log Requests policies by using the Data Transfer service.
PolicyAgentProvider.log Records policy changes.
PolicyEvaluator.log Records new policy settings.
RemoteControl.log Logs when the remote control component (WUSER32) starts.
Scheduler.log Records schedule tasks for all client operations.
Smscliui.log Records usage of the Systems Management tool in Control

Panel.

StatusAgent.log Logs status messages that are created by the client components.
SWMTRReportGen.log Generates a usage data report that is collected by the metering agent. (This data is logged in Mtrmgr.log.)

 

Rev. 2

-Harwelik -Harwelik

 

Page 12 of 12

Admin console install

Reviiew the log files: ConfigMgrPrereq.log,ConfigMgrSetup.log, and ComponentSetup.log located at the root of the C: drive.

 

Admin console

Reviiew the log file: SmsAdminUI.Iog, located at C:\Program Filles\ConfigMgr Admin

Console\AdminUI\AdminUILog.

 

Operating System  Deployment

You will want to use the smsts.log to help you troubleshoot OSD issues. The location of the log file can vary. Here is the list of locations of the smsts.log:

 

General location for all operatiing system deployment and task  sequence log events. Log  file location:

 

•   If task sequence completes when running in the full operating system with a Configuration Manager

 

2007  client installed on the computer: <CCM Install Dir>\fogs

 

•   If task sequence completes when running in the full  operating system with  no Configuration Manager

 

2007  client installed on the computer: %temp%\SMSTSLOG

 

•   If task  sequence completes when running in WindowsPE: <largest fixed  partition>\SMSTSLOG

0’Note

<CCM  nstall Dir> is %windir%\svstem32\ccm\loqs for most Confiquration Manaqer 2007  clients and is

<Configuration Manager 2007  installation drive>\SMS CCM for the  Configuration Manager 2007  site server. For  64-bit operating systems, it is %windiiiir%\SysWOW64\ccm\logs.

Rev. 2

-Harwelik  umnad@umn.edu

 

Be Sociable, Share!

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *