Brandon Linton - System Center and OS Deployment Blog

Retirement...

Brandon Linton — Mon, 05 Nov 2018 17:55:12 GMT

All good things must come to an end eventually... No no i am not retiring just yet but with the recent trend of Technet blogs being retired, i have chosen to migrate my blog over to my own WordPress platform to ensure i can still continue to provide content to the community and hopefully help others in their pursuit of knowledge. [caption id="attachment_675" align="alignleft" width="300"] Neon Sign On A Brick Wall - We Are Open[/caption] All new content will be at https://lintnotes.com so please head over bookmark, share etc. and ill be sure to get some fresh content posted over there in the coming days, weeks as the new year approaches. Thanks to all that have followed me and have provided feedback to help grow the greater System Center Communities! Thanks, Brandon Linton

Sysprep Fails if installing Windows Management Framework 5.1

Brandon Linton — Thu, 03 May 2018 01:45:36 GMT

If you happen to be unfortunate enough to still be creating Windows 7 or Windows Server 2008 R2 SP1 Images you might be so inclined to have your reference image as up to date as humanly possible with an OS that shouldn't be deployed at this point. Nevertheless if this is you i happen to have stumbled upon this myself and found the following blog post https://sccm-zone.com/fix-sysprep-error-on-windows-2008-r2-after-windows-management-framework-5-0-installation-b9e86b4c41e4 which details setting the following registry key to bypass this error.

Error:

Sysprep_Generalize_MiStreamProv: RegDeleteValue for target uri failed with error = 2[gle=0x00000002]
Sysprep_Generalize_MiStreamProv: RegDeleteValue for full payload time failed with error = 2[gle=0x00000002]

Fix:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\StreamProvider] “LastFullPayloadTime”=dword:00000000

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

Windows 10 RS3 , 1709 , 16299 Resources for OS Deployment

Brandon Linton — Wed, 18 Oct 2017 22:13:42 GMT

10-18-2017 Updated to include Windows 10 Language Packs and Remote Server Administration Tools By now you probably have seen that Windows 10 RS3 released yesterday 10/17/2017. Its available via MSDN, MVLS and any other channels you may use. Additionally you might find the following links useful if you are planning on creating a reference image, doing OS Deployment or simply managing the latest Windows 10 release in your environment. Windows 10 RS3: Download via MSDN or MVLS Windows 10 RS3 ADK: https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit Windows 10 RS3 Administrative Templates: https://www.microsoft.com/en-gb/download/details.aspx?id=56121 Windows 10 RS3 Security Baseline: https://blogs.technet.microsoft.com/secguide/2017/10/18/security-baseline-for-windows-10-fall-creators-update-v1709-final/ Windows 10 RS3 Language Packs: https://blogs.technet.microsoft.com/mniehaus/2017/04/26/finding-windows-10-language-packs/ Windows 10 RS3 RSAT: https://www.microsoft.com/en-us/download/details.aspx?id=45520 As additional items become available ill continue to update this post with more resources. A couple of items to consider if you are a ConfigMgr customer. ConfigMgr 1706 supports Deployment and Management of Windows 10 RS3 currently. At the moment i do not believe we have “support” for Windows 10 ADK 1709 so i would wait for an official stance on this before implementing in your environment. I would suspect that this would come with the next release of ConfigMgr if not sooner but proceed with caution before upgrading to this release of the ADK until you get confirmation that it is officially support and with what release its supported on. Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

ConfigMgr Queries and Collections for Windows 10 Versions

Brandon Linton — Wed, 18 Oct 2017 21:36:02 GMT

With the recent release of Windows 10 RS3 aka 1709 aka build 16299 i thought it was a good time to post some queries and collections for each Windows 10 version released so far. Additionally i also included Queries for each OS released as far back as XP that i happened to have access to at the time of this post. The Query itself is very simple and i like to create queries for reuse later on with collections etc. so my admins can easily reference these for reuse without unknowingly deploying to the wrong systems… “I kinda just don't trust anyone” its part of the job. "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.BuildNumber = \"16299\"" For a full comprehensive list of Windows 10 Build history see the link below. https://technet.microsoft.com/en-us/windows/release-info.aspx If you would like to skip all the manual stuff you can go ahead and grab the mof files for import for collections and queries below and be on your way. Queries-And-Collections Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in theTerms of Use.

ConfigMgr OSD Model Check Task Sequence Step

Brandon Linton — Tue, 17 Oct 2017 01:01:38 GMT

Ok this step is super easy and in my opinion a must have when it comes to Operating System Deployment. I cant count how many times a separate organization or technician for that matter grabs a system out from under their desk or purchases something off the internet without running it past their image engineering teams… I know shocking this happens with all the standards we all have in place right… Usually when this happens its a model we DONT support we haven't tested and obviously do not have the drivers loaded for, Bios Configurations or any other model specific applications setup and tested for this model. Low and behold we generally get a frantic call that imaging is DOWN! Well that hardly ever is the case its usually an unsupported non tested model being imaged without our knowledge. This step just makes so much sense and is so easy you should implement it immediately and save face before someone sends you chasing ghosts on a Friday right before the day is about to end… Blocking your Task Sequence from running on unsupported models might seem harsh to some but personally i value my time away from work and want to make the most of it and if we can block someone from doing something they shouldn't be doing in the first place and increase our personal time than that is a WIN in my book! So the nitty gritty simply add a Run Command Line step as one of the first steps in your task sequence and copy this Powershell one liner into the command line field: Powershell.exe -Command If(@('Surface Book','Surface Pro 4','Venue 11 Pro 7139','HP Probook 650 G2','Virtual Machine','VMware Virtual Platform') -contains (Get-WmiObject -Class Win32_ComputerSystem).Model){Write-Host "Supported Model Detected:"(Get-WmiObject -Class Win32_ComputerSystem).Model; Exit 0}Else{Write-Host "Error:Unsupported Model Detected:"(Get-WmiObject -Class Win32_ComputerSystem).Model; Exit 1633} Make sure to add or remove any of the supported models in your enterprise to insure you have full coverage and enjoy your weekend! Computer Models SQL Query: select distinct model0 as ‘Computer Model’, COUNT(0) AS ‘Number of Machines’ from Computer_system_data group by model0 order by count(0) desc Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in theTerms of Use.

ConfigMgr Compliance Baseline to verify Windows Activation Status

Brandon Linton — Mon, 16 Oct 2017 23:35:14 GMT

In most environments we are running KMS and don’t tend to think to often about our activation status but with more and more systems coming and going with BYOD and god knows what else your technicians are doing throughout your enterprise its good to have some piece of mind from a ConfigMgr perspective and validate that your systems are indeed licensed properly. In this post ill provide the Powershell code for detection and remediation utilizing the KMS Client Setup Keys from https://technet.microsoft.com/en-us/library/jj612867(v=ws.11).aspx as well as the Compliance Baseline to import and implement for a few operating system types. Feel free to extend for your supported operating systems. Discovery Script: #Windows Activation if((cscript "$env:SystemRoot\system32\slmgr.vbs" -dli all) -Contains "License Status: Licensed") { Write-Host $False } else { Write-Host $True } Remediation Script: # Determine OS and Set KMS Client key switch ((gwmi -Class Win32_OperatingSystem).Caption) { "Microsoft Windows Server 2008 R2 Enterprise" {$License = "489J6-VHDMP-X63PK-3K798-CPX3Y"; break} "Microsoft Windows Server 2008 R2 Standard" {$License = "YC6KT-GKW9T-YTKYR-T4X34-R7VHC"; break} "Microsoft Windows Server 2008 R2 Datacenter" {$License = "74YFP-3QFB3-KQT8W-PMXWJ-7M648"; break} "Microsoft Windows Server 2012 R2 Standard" {$License = "D2N9P-3P6X9-2R39C-7RTCD-MDVJX"; break} "Microsoft Windows Server 2012 R2 Datacenter" {$License = "W3GGN-FT8W3-Y4M27-J84CP-Q3VJ9"; break} "Microsoft Windows Server 2016 Standard" {$License = "WC2BQ-8NRM3-FDDYY-2BFGV-KHKQY"; break} "Microsoft Windows Server 2016 Datacenter" {$License = "CB7KF-BWN84-R7R2Y-793K2-8XDDG"; break} "Microsoft Windows 10 Enterprise" {$License = "NPPR9-FWDCX-D2C8J-H872K-2YT43"; break} default {$License = "Unknown"} } #Windows Activation If($License -ne "Unknown"){ Write-Host "Activating Windows..." cscript "$env:SystemRoot\system32\slmgr.vbs" -ipk $License //nologo cscript "$env:SystemRoot\system32\slmgr.vbs" -ato //nologo } Compliance Baseline: Microsoft-Volume-License-Activation If you have any feedback or want to provide more captions from Win32_OperatingSystem.Caption please comment with your additions and ill update the post. Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in theTerms of Use.

Updated Win32_SystemEnclosure Chassis Types

Brandon Linton — Fri, 15 Sep 2017 18:48:55 GMT

The Win32_SystemEnclosure WMI Class has been rather valuable over the years in order to properly detect and target specific software, drivers etc. to a particular type of system. The problem is that while it has been a staple over the years it has had many revisions. These revisions are part of the DMTF Specification in the SMBios, and within the recent few years we have seen changes which required new system chassis types to identify these hybrid devices. If you look at the Class on MSDN linked above you'll see that the ChassisTypes Property has not been updated to reflect newer options since the original DMTF Specification 2.3.0 more than a decade ago. Since that time 12 new chassis types have been introduced. Technologies like MDT that still leverage this class will need to be updated with the below list if they are being utilized in your environment so that your deployments continue to work as these new breed of devices start to transition themselves into your fleet of supported models. This applies to any scripts or Group Policies as well that require this level of targeting. Hopefully this list helps someone save a few minutes of their day. As a side note there are other ways to test for these conditions by checking Win32_Battery or by using Win32_ComputerSystem and the PCSystemType Properties but all have there own downsides i am curious to here what has been most reliable for you all! Below is the current list as of version 3.1.1 posted 1/13/2017. Other (1) Unknown (2) Desktop (3) Low Profile Desktop (4) Pizza Box (5) Mini Tower (6) Tower (7) Portable (8) Laptop (9) Notebook (10) Hand Held (11) Docking Station (12) All in One (13) Sub Notebook (14) Space-Saving (15) Lunch Box (16) Main System Chassis (17) Expansion Chassis (18) SubChassis (19) Bus Expansion Chassis (20) Peripheral Chassis (21) RAID Chassis (22) Rack Mount Chassis (23) Sealed-case PC (24) Multi-system chassis (25) Compact PCI (26) Advanced TCA (27) Blade (28) Blade Enclosure (29) Tablet (30) Convertible (31) Detachable (32) IoT Gateway (33) Embedded PC (34) Mini PC (35) Stick PC (36) Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in theTerms of Use.

Its been awhile

Brandon Linton — Fri, 15 Sep 2017 16:26:47 GMT

It certainly has been awhile with so many life and technology changes its time to resurrect this blog from the dead and start contributing once again. This post will be brief but wanted to set the stage that I will be starting from square one on a lot of topics and technologies just incase anyone needs or wants to start learning about Microsoft Technologies that I am passionate about they will have the option to learn the basics again like installation and configuration as well as more advanced topics in the deep dive sessions of troubleshooting and some of the learnings going from customer to customer that can be shared. Thanks, Brandon

Microsoft Deployment Toolkit 2013 Update 1 Re-released Build 8298

Brandon Linton — Tue, 15 Sep 2015 12:01:08 GMT

Looks like Aaron and team have been busy ramping up the latest build release of MDT 2013 Update 1 which should address many known issues.

The following issues are fixed in build 8298

Multiple drive partitioning issues are addressed by significant revisions to the Format and Partition Disk step (see release note below), including:
- Upgrading to MDT 2013 Update 1 does not work for UEFI systems
- An extra unneeded partition is created on both UEFI and BIOS systems
- You cannot specify a custom partition layout containing a "Recovery"-type partition needed for UEFI systems
- LTIApply error, "There is not enough space on the disk"
- WINRE_DRIVE_SIZE from ZTIDiskpart.wsf is Too Small
Multiple issues related to XML processing:
- Application bundles returning error 87
- Selecting a keyboard locale in the Deployment Wizard
- Deployments failing due to Unattend.xml errors
- ZTIPatches returning error "Object required (424)"
- Cleanup after image capture doesn't remove LTIBootstrap entry
Several issues with the Windows 10 in-place upgrade task sequence including:
- The upgrade process ends with warnings "Unable to create WebService class"
- The upgrade task sequence is available from Windows PE
- After upgrade a System_License_Violation blue screen appears
Applications that use a command file start using System32 as the working directory
Spanned images cannot be applied

To read the full Blog head over to the MSDeployment blog: https://blogs.technet.com/b/msdeployment/archive/2015/09/15/mdt-2013-update-1-re-released-build-8298.aspx

SCAP Extensions version 3.0 for System Center Configuration Manager Now Available!

Brandon Linton — Fri, 04 Sep 2015 18:02:57 GMT

The Configuration Manager Sustained Engineering team is pleased to announce the release of the SCAP Extensions version 3.0 for System Center Configuration Manager. You can download it from the Microsoft Download Center: https://www.microsoft.com/en-us/download/details.aspx?id=48741. This new release of the SCAP Extensions was validated on August 28^th 2015 by the National Institute of Standards and Technology (NIST), for version 1.2 of the Security Content Automation Protocol (SCAP) specification with Authenticated Configuration Scanner capability with Common Vulnerabilities and Exposures (CVE) option.

What’s new in this release

SCAP Extensions version 3.0 for System Center Configuration Manager:

Fully supports converting SCAP Content to Compliance Settings baselines for:

System Center 2012 Configuration Manager SP1
System Center 2012 Configuration Manager SP2
System Center 2012 R2 Configuration Manager
System Center 2012 R2 Configuration Manager SP1.

Supports SCAP version 1.2 and is backward compatible with SCAP versions 1.1 and 1.0.

Supports Extensible Configuration Checklist Description Format (XCCDF) version 1.2.
Supports Open Vulnerability and Assessment Language (OVAL) versions up to 5.10.
Supports generating Asset Reporting Format (ARF) 1.1 reports.
Supports Common Platform Enumeration (CPE) 2.3
Supports Common Vulnerabilities and Exposures (CVE)
Supports Common Configuration Enumeration (CCE) version 5
Supports USGCB Internet Explorer 8, USGCB Windows 7 and USGCB Windows 7 Firewall.

Allows selection of SCAP Source Data Streams, and XCCDF benchmarks and profiles for conversion.
Allows selection of a standalone OVAL file or an OVAL file paired with an OVAL external variable file.
Supports generating the Cyberscope Lightweight Asset Summary Results (LASR) report.
Supports generating SCAP reports based on collections in addition to reports based on a single machine.
Allows conversion to multiple Configuration Baselines from a single source to achieve better load-and-balancing on the client during evaluation.
Uses Windows PowerShell scripts instead of VBScripts in the Configuration Items for all OVAL test types.
No longer needs to deploy an inventory tool to client machines, such as SCMDCM.exe used in the prior release.

You will find more details on the Microsoft Download Center here. For additional information, refer to the SCAP Extensions 3.0 for System Center Configuration Manager user guide. The SCAP section of the NIST Web site at https://nvd.nist.gov/scap.cfm contains the SCAP specifications, information about the SCAP validation program and the SCAP content.