As a result of this process, we’ve got the Software Updates metadata synchronized and the result can be viewed from the Configuration Manager console

Throughout this article, we will select few updates and deploy them to a collection of Windows 7 machines. Before we do that, it would be nice to review the Software Update policy to make sure its properties satisfy our business needs.

From the Client Settings in the Administration tab, Click Software Update

If you are planning to use Software Update point to patch your environment, make sure you do not configure domain policy for client computers to receive updates from WSUS through Group Policy Settings. The group policy settings used by Windows Update Agent (WUA) on client computers will override any machine policy sent from Configuration Manager and hence the client agent will retrieve the updates specified by the “unmanaged” WSUS.

Deploying Software Updates to client machines is simply the process of adding software updates to a software update group and then deploy the software update group to clients. There are actually two methods to deploy updates. The first one is a manual process where we select updates from the console and deploy it to a collection of machines and the second method is automatic by using an automatic deployment rule or by adding software updates to an update group that has active an deployment.

At your initial install, you might need to use first the manual method to get your devices up-to-date with required software updates and then you create an automatic deployment rule to manage your ongoing monthly software update deployments.

As you’ve seen in our first screenshot, there are hundreds of updates in the console. The first step here would be to filter the updates by criteria.

To do so, from the Configuration Manager console, click Software Library.

Expand Software Updates and click All Software Updates.

In the search pane, click Add Criteria and select the criteria that you want to use to filter software updates and click Add

Click Search to filter the Software Updates

Select the updates you wish to deploy, right click on your selection and click Deploy

On the General page, specify the name of the deployment, the software update group name and the collection where the updates will be deployed

On the Deployment Settings page, make sure Required is selected as the Type of deployment to make sure the updates will be mandatory with an installation deadline and Minimal for Detail level.

On the Scheduling page, select Client local time, on the Software Available Time, select As soon as possible to make sure clients are notified for updates installation as soon as their next policy polling cycle and on the Installation deadline, specify a time where the software updates will get installed automatically

On the User Experience page, you can keep the default settings and click Next

On the Alerts page, configure how Configuration Manager and Operations Manager will generate Alerts

On the Download Settings page, when a client is connected to a slow network or is using a fallback content location, specify whether the client will download and install the software updates and when the content for the software updates is not available on a preferred distribution point, you can specify whether to have the client download and install the software updates from a fallback distribution point and on the Allow clients to share content with other clients on the same subnet: specify whether to enable the use of BranchCache for content downloads

On the Deployment Package page, select to create a new deployment package and specify its properties

On the Distribution point page, select the distribution point to host the software update files.

On the Download location page, select to Download software updates from the internet

On the Language selection page, select the languages for which the selected software updates are downloaded.

On the Summary page, review the settings and click Save As Template to save the settings for a future deployment

Click Next and on the Completion screen click Close.

At this stage, you would need to wait for the next policy polling cycle on the client machine or you can force the client machine to retrieve the machine policy by double clicking the Configuration Manager Client Agent found in Control Panel.

From the Actions tab, select Machine Policy Retrieval & Evaluation Cycle and click Run Now

After few seconds, you will notice a notification message

From the Software Center, you can check the Software Updates deployment settings

Once the updates get installed, you will be able to view the installed updates with a description of each update

This comes to the end of this article where we’ve discussed the required steps to deploy Software Updates to devices. We will be discussing in a future article the automatic deployment rule when it comes to Endpoint Protection.

Throughout this article, we will install and configure Software update point.

From the Configuration Manager console, click Administration, expand Site Configuration and click Servers and Site System Roles.

Right click the primary server and click Add Site System Roles

On the General page, click Next and on the System Role Selection page, check Software update point

On the Software Update Point page, specify proxy settings if needed to connect to the internet to synchronize and download content.

On the Active Settings page, select to Use this server as the active software update point and choose to use the custom WSUS website

On the Synchronization source page, select to Synchronize from Microsoft Update. This option is only available for stand-alone primary servers and for CAS servers. Secondary servers and primary servers within a hierarchy are automatically configured to upstream through their parent site.

Under WSUS reporting events, keep the default selection since Configuration Manager doesn’t interpret WSUS reporting events.

On the Synchronization Schedule page, check to Enable synchronization on a schedule and check to Alert when synchronization fails on any site in the hierarchy

On the Supersedence Rules page, if you click to immediately expire a superseded software update, you will be able to see the expired updates in the Configuration Manager console for a period of 7 days. Following that, expired updates that are not associated with any deployment will be tomb-stoned.

You can select some time if you would need to wait before a superseded software update is expired

On the Classifications page, select the classification you want to synchronize

On the Products page, select the products you want to synchronize

On the Languages page, select the language you want to synchronize

On the Summary page, click Next

On the Completion page, click Finish

From the Configuration Manager console and from the Administration tab, click All Software Updates and click Synchronize Software Updates

Click Yes on the informational box

You can monitor the synchronization progress by checking wsyncmgr.log

This comes to the end of this article. In our next article we will deploy updates to desktop machines.

In this article, we will first install WSUS and later we will walk through the installation and configuration of the Software Update point.

From the Server Manager, right click Add Roles and click to add the WSUS role

On the Before you begin page click Next and on the Add Roles Wizard, select Windows Server Update Services

Click Next on the Windows Server Update Services page and click Install on the Confirm Installations Selections page

Click Next on the Setup Wizard page

Click the checkbox to accept the License Agreement and select the Store Update location

Select to use the existing database and click Next after successfully connecting to the SQL Server instance

On the Web Site selection, select to create a custom website

Click Next twice to start the installation

Click Finish on the completion page and click Cancel on the Windows Server Update Services Configuration Wizard since we will configure these settings from the Configuration Manager console.

This comes to the end of this article where we’ve install WSUS. In our next article we will go through the installation and configuration of Software Update point.

Throughout this article, we’ll cover Client Settings which was known as Client Agent Settings in Configuration Manager 2007.

One of the major changes in this area that Client Settings are now configured on the hierarchy level. With ConfigMgr 2007, Client Agent Settings are configured on a site level. Having that said, you didn’t have the option to configure different client agent settings for agents that exist within the same Configuration Manager site.

In System Center 2012 Configuration Manager, client settings are hierarchy based. The default client settings policy is applied to all agents within the hierarchy and additional client settings policies can be created and applied to collections. These collections could be a group of computers or a group of users.

The following client settings can be applied for devices (click on the policy to know more information):

• Client Policy
• Computer Agent
• Computer Restart
• Endpoint Protection
• Hardware Inventory
• Network Access Protection (NAP)
• Software Deployment
• Software Updates
• User and Device Affinity

The following client settings are for users:

• Mobile Devices
• User and Device Affinity

To create a new custom client settings for a user or a device, go the Administration tab in the console, right click Client Settings and select to create a new policy setting

Select a custom setting such as Remote Tools and click on Remote Tools from the upper left box to configure settings

Click Configure, check the box to Enable Remote Control on client computers and check the box of the Domain profile to automatically configure the Remote Control port and program exceptions for clients.

Set your other settings as desired and click on Set Viewers

Type the permitted viewers such as a user or a group and click OK

Once done you will notice the newly create device settings

If it happens to have two policies such as Remote Control settings and both being applied to the same collection, the policy with lower priority value will take over any other policy.

You can increase or decrease the client settings priority by right clicking the policy and selecting to increase the priority

To deploy the newly created policy to a device collection, right click the policy and click Deploy

Select the device collection and click OK

From the properties of the device collection, you will notice that the custom settings now appear as being applied to the collection

We’ve also seen the Forest Discovery Method which aim to automatically create boundaries based on the discovered IP subnets and Active Directory Sites.

To check the created boundaries. go to the Administration tab and click on Boundaries

Even though, the boundaries do exist, each boundary would need to to be a member of a boundary group before a device on that boundary can identify an assigned site or a distribution point.

On the other hand, boundaries are no longer site specific, instead defined for the hierarchy which make them available at all existing sites of that hierarchy. Boundaries are defined under the Hierarchy Configuration from the Administration tab.

From Boundary Groups, click Create Boundary Group

In the Name field, type the name for the boundary group and click on Add to add boundaries to the boundary group

On the References tab, check Use this boundary group for site assignment and click Apply

During automatic site assignment, the selected site will be used for client assignment that exists within the defined network location. If one particular boundary is added to many boundary groups where these groups are configured for client assignment, new installed clients will nondeterministically select one of the sites and we will have an overlap of boundary configuration. This scenario is not supported in Configuration Manager.

You might also have noticed from the References tab that we can add and associate one or many distribution points or state migration points to the boundary group

During a software distribution or an operating system deployment, the client request a location for deployment content or a location to send/receive state migration information (in OSD). The Configuration Manager send the client a list of distribution/state migration point that are associated with the boundary group of the client current network location. The client in this case will select the nearest server point.

The network connection speed is now defined for a distribution point and from within the boundary group

As a best practice, create boundary groups for site assignment and another set of boundary groups for content location. This will help you eliminate the chances for users getting assigned to wrong sites whenever they are roaming.

This comes to the end of this article where we’ve discussed boundaries and boundary groups.

Stay tuned  for our next one!!

Throughout this article, we will configure discovery methods for our primary site.

From the Administration tab, expand Hierarchy Configuration and click Discovery Methods

As you have noticed, Active Directory System Group discovery has been removed and Active Directory Security Group has been renamed to Active Directory Group Discovery and discovers the group memberships of resources.

By default, Heartbeat Discovery is the only enabled discovery method. Heartbeat discovery is pre-configured to run every 7 days on every computer and it aims to create a discovery data record (DDR)  which contains the network location, NETBIOS name and operational status details. The DDR (size of 1KB) is submitted to the management point and processed by the primary site to maintain the active client’s record in the database or force the discovery of an active client that have been removed from the database, or that has been manually installed and not discovered yet.

As a best practice, keep the heartbeat discovery method enabled all the time and if you need to modify the schedule the discovery runs make sure the value is always less than the value of the task Delete Aged Discovery Data which deletes inactive client records from the site database.

This task can be viewed from Site Maintenance

From the Discovery Methods page, double click Active Directory Forest Discovery.

Check to enable the forest discovery and check the other two options to Automatically create Active Directory site boundaries when they are discovered and to Automatically create IP address range boundaries for IP subnets when they are discovered

Active Directory Forest Discovery is a new method which will discover the IP subnets and the Active Directory sites and add them as boundaries. We will be covering later how we can use the discovered information for site boundaries.

This method is scheduled by default to run every 7 days and it doesn’t support Delta Discovery. You can always run the method if you right click on it and select to Run Full Discovery Now

If you go to Boundaries, you will notice the automatic creation of boundaries

The above Forest Discovery ran on the top-level site of the hierarchy.

You can also run this method on other Active Directory Forests. To do so, go to Active Directory Forests from the Administration tab and select the Forest you want to discover.

On the General page, you’d need to specify an account from the designated forest that has the privileges to discover Active Directory Sites and IP subnets and to publish information to the Active Directory. To do, this account must have full permissions on the System Management object in Active Directory.

Alternatively, the site server computer account can be used if he has permissions to do so.

On the Publishing page, you can select the site to be published to the designated forest.

You can monitor the Discovery Status and the Publishing Status from the lower right pane

You can also check further information on the status by checking the ADForestDisc.log file found in the <InstallationPath>\Logs

Next, double click Active Directory System Discovery and check to enable this method on the contoso.com domain

On the Polling Schedule tab, click to enable Delta Discovery.

Delta Discovery is not a full discovery but instead a method that will search Active Directory Domain Services (AD DS) for specific attributes that have changed since the last full discovery cycle. Even though, Delta Discovery will discover new resources and changes, it won’t detect when a resource is deleted from AD DS. If Delta Discovery is enabled for Active Directory Group Discovery, it will detect when computers or users are added or removed from a group.

On the Active Directory Attributes page, you can check the attributes that are selected for default discovery and you can select from the Available Attributes list a custom attribute such as “location” attribute and add it to the discovery method. This option has been improved from Configuration Manager 2007 R3

On the Option page, select the options to filter out stale computer records from the discovery. This is a new feature in the product which will help keep the site database up to date with active client records.

Let us enable Active Directory User Discovery on the contoso.com domain

Similar to Active Directory System Discovery, on the Polling Schedule page you can enable Delta Discovery and on the Active Directory Attributes page you can select additional attributes to be added to the default discovered attributes.

Those are the only discovery methods I will enable for my current environment.

This comes to the end of part 2 where we’ve configured discovery methods and discussed the new and the improved discovery functionalities.

In our next article, we will be discussing Boundaries and Boundary Groups.

In part 1, I’ll be driving you through the installation of a stand-alone primary site. For guidelines on installing the prerequisites, you can refer to my previous article Building Configuration Manager 2012 Hierarchy – Part 1 Installing prerequisites

Once you have completed the prerequisites installation, double click the Install button from the Configuration Manager media.

On the Before You Begin page, click Next

On the Getting Started Page, select Install a Configuration Manager primary site

On the Product Key page, select to use the product as evaluation period of 180 days or type in your product key

On the next two pages, Accept the Microsoft Software License Terms, the Prerequisite Licenses and click on Next

On the Prerequisite Downloads page, select a UNC path where you’ve downloaded the updates and click Next

On the Server/Client Language selection pages, keep the default value (English) and click Next

On the Site and Installation Settings page, fill in the Site Code, the Site Name and click Next

On the Primary Site Installation page, select to Install the primary site as a stand-alone site and click Next.

On the pop-up Configuration Manager informational message, click Yes

On the Database Information page, keep the default values and click Next

On the SMS Provider Settings page, make sure the site server name FQDN is selected and click Next

On the Communication page, select the second option and click Next

On the Site System Roles page, check to install a management point (MP) and a distribution point (DP) and click Next

Click Next on the CEIP page and on the Settings page

On the Prerequisite Check page, review the warnings and click Begin Install (you can ignore the WSUS warning message as we will be installing it in a future article)

Once the installation complete, make sure you have no errors in the core setup

From the Configuration Manager console, right click Application and click Create Application

Select Automatically detect information about this application from installation files and select PROPLUSWW.msi

Click Next twice and on the General Information page select Install for System and fill other informations as needed

Click Next twice and make sure the Create Application Wizard is completed successfully

Right click the Deployment Types tab found in the lower right pane of the console and click Properties

Select the Programs tab and replace the installation program field by setup.exe

On the Content tab, modify the content location to the Office 2010 root media

Now we have the application ready for deployment. Right click Microsoft Office Professional Plus 2010 and click Deploy

On the General page, select the collection you want to deploy Office 2010 and click Next

On the Content page, select a Distribution point or a distribution point group

On the Deployment Settings page, select Install from the Action field and available or required

Click Next on the remaining pages until you hit the Completion page

From the Client Machine and since we made this deployment of type available, let’s open Software Center and ignite the installation

Wait few minutes till the files get downloaded

The installation will start and once completed, the product will appear as installed

Checking SMSPORTALWEBSetup.log pointed me that IIS ASP.net was not registered

So I ran the aspnet_regiis.exe –I

At that point, I thought the issue was solved as the log showed a success for installing the portal web

After browsing the Application Catalog, I found that I wasn’t able to connect to the application server

The SMSAWEBSVCSSetup.log pointed me that the WCF isn’t activated

From the Add Features Wizard, I added the HTTP Activation

Opening again the Application Catalog, I got the following error: Error message after you install the .NET Framework 4.0: "Could not load type 'System.ServiceModel.Activation.HttpModule'"

Thanks to our KB2015129 article which explains the reason behind this error when enabling .NET 3.0 WCF HTTP Activation.

By running aspnet_regiis.exe /iru the issue was fixed!!

To have more than one primary site, you will need to make sure your hierarchy contains a Central Administration Site (CAS). More primary sites can be deployed by following same steps.

In this article, we will walk you through the process of deploying a Tier 3 Secondary Site Server.

As a required step, we would need to add the primary server computer account to the local administrator group on the secondary server.

Open Configuration Manager console, navigate to Administration section, expand Site Configuration and select Sites.

Right click on the primary server and select Create Secondary Server

Specify the Site Code, the Site Server Name and other information as shown below

Specify how the source files will be located and press Next

On the SQL Server Settings page, make sure the following ports are set correctly and click Next

On the Distribution Point page specify the following settings and click Next

On the Drive Settings page specify the following settings and click Next

On the Specify the content validation settings page, click Next

On the Specify the boundary groups page, click Create to create a new boundary group for the secondary site.

In the Name box, type Secondary Site Clients.

Click Use this boundary group for site assignment, and then in the Assigned site box, verify that PR1-Contoso Primary Site is listed, click OK and click Next twice

Verify that the creation wizard completes successfully.

After refreshing the console, navigate to Administration section, expand Site Configuration and select Sites.

Verify that the State shows as Active and check that the Site Code and Parent Site Code are correct

To monitor the health of the hierarchy, go to Monitoring and click Site hierarchy.

Expand the hierarchy and make sure the hierarchy is healthy by verifying the green check mark.

This comes to the end of this blog article and the deployment series.