This article assumes you are all familiar with the PowerShell cmdLets introduced in SP1 and forward. If not go here and welcome to the fun.

My current environment we have a lot of collections based upon dynamic AD group memberships. I do not  have control of when devices are add, moved or deleted from AD. Some of these collections have very tight Maintenance Windows (MW) applied. To complicate matters worse we also have very strict patching deadlines for compliance that follow a schedule. After discovering that some of my devices were added to a collection due to an updated AD Group membership that had MW applied post compliance reporting day. Needless to say they were not compliant.

I live for scripting especially if ConfigMgr is involved. I also enjoy PowerShell and Console Extensions. What an opportunity.

Disclaimer – there are always more than one way to get information.  This is my method.

A MW can be viewed in the Console in  the individual collection properties.

Well that sucks for me as I have many Collections and some with MW windows. I would much prefer to click on a device in the Console and say “show me your MW windows”. So now goal has been defined. Let’s jump into GUID hell

Yup – it’s good.

I created a new .xml for my right click console action:

<ActionDescription Class="Group" DisplayName="Show Me My Maintenance Windows" MnemonicDisplayName="Show Me My Maintenance Windows" Description="Show Me My Maintenance Windows"><ShowOn><string>DefaultHomeTab</string><string>ContextMenu</string>  </ShowOn><ActionGroups> <ActionDescription Class="Executable" DisplayName="Show Me My Maintenance Windows" MnemonicDisplayName="Show Me My Maintenance Windows" Description = "Show Me My Maintenance Windows" RibbonDisplayType="TextAndSmallImage"><ShowOn><string>ContextMenu</string><string>DefaultHomeTab</string></ShowOn>
<Executable><FilePath>showmw.bat</FilePath><Parameters>"##SUB:Name##"</Parameters></Executable></ActionDescription>
</ActionGroups></ActionDescription>

This provides:

I use a batch file so I can make quick changes to avoid closing the console and refreshing the right click xml.

And yup – this one does have a MW.

The Powershell script.

You can modify the script to remove the NetBIOS_name0 clause to find all devices if desired. This is just the start framework and the possibilities are endless to instant information with PowerShell and ConfigMgr.

Until next time.

http://blogs.technet.com/b/configmgrteam/archive/2013/03/01/when-not-to-use-ip-address-ranges-as-boundaries-in-configuration-manager.aspx

Some views/tables in CM2012 will store data as XML. You can find out the data type by using the sp_help function. For example:

sp_help v_configurationitems

You can see that SDMPackageDigest is a data type of XML. I wonder what’s in there? HMM.. let’s go look.

Looks familiar? My XML Notepad test package.

From there you can generate any type of report necessary using Report Builder. This sample reports (shout out thanks to Lou Smathers for the report) shows all Application Deployment Type versions along with the Application Version. This was pulled with the following SQL Statement.

;WITH XMLNAMESPACES ( DEFAULT 'http://schemas.microsoft.com/SystemCenterConfigurationManager/2009/AppMgmtDigest') 

select  App.DisplayName, App.SDMPackageDigest.value('(/AppMgmtDigest/Application/DeploymentTypes/DeploymentType/@Version)[1]', 'nvarchar(10)') [Version]   

,sdmpackageversion 

from fn_ListApplicationCIs(1033) App 

where sdmpackageversion =  (SELECT MAX (sdmpackageversion) 

                            FROM fn_ListApplicationCIs(1033)App2 

                           WHERE app.modelid = App2.modelid) 

order by DisplayName

Now for the IMPORTANT PAY ATTENTION information.

1. All Syntax is CASE and Whitespace Sensitive.  Review Here.

Example:

This will not work and return NULL

Case must Match. Title

Here is the correct SQL

;WITH XMLNAMESPACES ( DEFAULT 'http://schemas.microsoft.com/SystemCenterConfigurationManager/2009/AppMgmtDigest' )

select SDMPackageDigest.value('(/AppMgmtDigest/DeploymentType/Title)[1]', 'nvarchar(MAX)') [Title] 

 from v_ConfigurationItems

where CIType_ID = 21

With xQuery and following the above syntax you can retrieve the data stored in the xml. For attributes you need to change like as follows:

select SDMPackageDigest.value('(/AppMgmtDigest/DeploymentType/Title/@ResourceId)[1]', 'nvarchar(MAX)') [ResourceID]

Here is an example where I pulled information for Applications from the v_configurationItems, XML Column, SDMPackageDigest. Note that you can use the Where and AND with the xQuery as well.

xQuery is so much fun! I hope this post has been useful. Now back to the Application Model in Configuration Manager 2012.

For those of you are curious, this is the first sql query I used to extract data.

Yes, my SQL Server did call me up and cry just a little bit then asked me to look at xQuery.

Enjoy xQuery!

Part 2 will cover Requirements.

This is a big area to cover!

What is a Global Condition?

A Global Condition is way to logically group business or technical requirements into a single assigned requirements for an Application.  There are 10 areas to explore:

1. Active Directory Query
2. Assembly
3. File System
4. IIS MetaBase
5. Registry Key
6. Registry Value
7. Script
8. SQL Query
9. WQL Query
10. XPath Query

1. Active Directory

This uses standard LDAP or GC query syntax.  Nothing special here and if you know LDAP you can quickly use this to group Business areas to their OU’s, etc.

2. Assembly – Checks in the GAC for the assembly.

3. File System – Searches the file system. Take special note here that you can  use System variable including the %UserProfile%. If you do use %UserProfile% it will search all profiles. So be careful what you are identifying as a requirement. See Script option if you need to be more specific. Sorry – no UNC support here.

4. IIS MetaBase – You can check in the IIS MetaBase for a particular setting. Pretty self-explanatory.

5. Registry Key – Can check for a KEY – Both 32 and 64 bit.

6. Registry Value  - Can look for a value.

7. Script – Has to be my favorite option. Here you can write in Powershell, VBScript or JScript. With scripts you can be as complex as you want. Big happy dance that you can also check to have the script run as the user.

8. SQL Query – Wow… second favorite option. SQL Query against the default instance – saves me the time from writing it in the Script option. However, take note if you are clustered. As soon as I find time, I ‘ll dedicate a few hours to discuss installation, operations and troubleshooting Configuration Manager 2012 on a SQL Cluster. By the way, have you seen time? I’ve been looking but can’t seem to find it.

9. WQL – Query WMI using this option. Excellent addition.

10. XPATH – Hmm. I’m sure this can be useful. Query XML.

Using the Global Conditions is really “big picture thinking” when it comes to deployment of Applications in an Enterprise environment.  Best to use this as a way to logically group like requirements and do the work only once.

Besides the ability to create your own, Configuration Manager 20112 includes 16 pre defined default Global Conditions for you to use.

They are as follows:

1. Active Directory Site
2. Available internal storage
3. Configuration Manager site
4. CPU Speed
5. Device type
6. Disk Space
7. Input Type
8. Number of processors
9. Operating system Mobile
10. Operating system Windows
11. Operating system language mobile
12. Operating system language Windows
13. Organization unit (OU)
14. Primary device
15. Screen resolution
16. Total physical memory

Global Conditions return values are mapped as data types. For example, Boolean,  String, Integer, etc.

Now onto requirements.

In each Deployment Type you can set Requirements that will be used to evaluate if the Deployment Type applies.

Note that these requirements by default are re-evaluated every 7 days. You can increase this setting as necessary. (client setting - Schedule re-evaluation for deployments)

When you start the “Create Requirement” you have three options

1. Custom
2. Device
3. User

1. Custom

This allows you to pick from a previously created Global Condition or create a new one.

2. Device

3. User

As an example for this review, I created a new Application XML – Notepad. I set the CPU requirement to 100 – something my test box certainly does not have.

After deploying and refreshing my policies,  the Client logs files, AppDiscovery.log will show that this Deployment Type is not applicable for my client. This is due to the failure of # of processer in my requirements.

For fun (I’m strange huh), I thought it might be possible to use the Script option to run pre-distribution tasks. For example, deleted old files, etc prior to an MSI installation. While fun, that’s not a good idea as it will run on everybody.

In the following example, I created a custom condition “islegal”.

and added it to my example as such:

Now I can use this to determine if my DT targets are part of my legal team.

There are many combinations of rules that you can create. Each type and combination will have specific results.

Here this might help clarify it for you:

This will come in handy when I start talking about thread surfing; but that’s much later when I find time.

Up Next Part 3. Dependency

Ever since I laid eyes on you I have been blown away thinking of the all possibilities that you will bring.  Sometimes I wake up at night with nightmares that this is all just but a dream. Pinch me am I awake! You wouldn’t believe the things that I’ve been through over the last few years. Now don’t get me wrong, the SMS platform has provided a best of class infrastructure for my master System Admins to use. In fact they are quite creative and have done things that are of epic proportions, such as delivering to my peers a flawless upgrade of Office 2010 with 20 language packs across networks that I am sure were 50% shoestring. I can’t wait for them to discover you. Are you ready?

This brings me back to my first memory of you. When you first deployed an application using the new Application Model in Configuration Manager 2012 the force was strong in my WMI layers of goodness.  Without much effort was I able to apply state management to the application you delivered. I immediately told the nearest machine about the wonders I’ve discovered. At first they didn’t grasp it. I created the following diagram to help in my discussions:

Before we discuss this in detail you should review the Application Management of Configuration Manager 2012 located here view.

Forever Yours,

Windows Operating System

Now on a more serious note I’d like to review the areas of Detection, Requirements, Supersedence and Dependency of the Application Model which I find to be so much fun.

In this Part 1, I will focus on the Detection section.

I summed up Detection as “Things that tell me I exists”. It is the area in which the new application model uses to discover if a targeted Deployment Type is present.

There are 5 ways to determine this:

1. MSI Product Code
2. File
3. Folder
4. Registry
5. Custom Script

Note: Detection runs after a Application Deployment Evaluation policy refresh

#1 MSI Product Code  - is pretty self explanatory, find the MSI product code and if it exists then it is present. Key here is getting the MSI product code. Thankfully when you create an new application it will detect and automatically provide this for you and generate a Deployment Type.

#2  File - is based upon a file (yes it that simple):

There are additional options in this section to either choose to have just the file or a rule to check for Date Modified, Date Created, Version or Size (in Bytes)

#3 is Folder and is very similar to the file item.

Note that the options change you now have only Date Modified and Date Created:

#4 is the Registry:

You can browse to a machine and select the appropriate key OR you can manually enter the information. Additional options are available. (equal, not equal, etc)

Note:

#1 through #4 can be joined together with And / Or for detection. If you select the next option #5, script, you lose the above and will have to move them to your script if desired.

#5 is scripting. This is where the fun can really begin for those applications that have complicated installations. Wait, we never see those right?

Script options are PowerShell, VBScript and JScript.

All of these Detection options can be found in the Deployment Type under the Application. There can multiple deployment types per application.

In the next parts I’ll cover Requirements, Supersedence, Dependency, Examples/Expected Behavior and end with Troubleshooting (thread chasing).

Go forth and deploy!

Now you can download the Configuration Manager 2012 documentation in one document. This is very helpful when searching for information.

http://www.microsoft.com/en-us/download/details.aspx?id=29901

With SCCM 2007, content is stored on a distribution point in package ID folders. If you knew the package ID, you could browse to the file share and install/run manually.

This option is more complicated now in Configuration Manager 2012. The files are not just stored on a drive in a manner you could just copy and execute.

The following blog post is about the new Content Library and my attempts to reconstitute a package from the Single Instance Store.

By default, the content is single storage and browsing to a DP does not store all the files in a package id folder where you could find an install and execute it. You can enable the older method which will create a separate folder share. This will require double the disk space! Obviously, this is a pain point for those who use the distribution points this way as a mitigation step in a crisis.

To understand how the Content Library works in Configuration Manager 2012, I decided to find a way to solve this pain point.

This functional diagram is my review of the single content library:

Content Layer

In the Content Layer, individual files are sent and only stored once in a single storage location. For example, there might be three packages that need to be distributed in a Configuration Manager 2012 infrastructure. All three packages contain the same file Psexec.exe with the same md5\sha1\sha2 hash value.

Why send the file and store it in three places?

Great efficiencies are gained with the new shared single storage Content Library in Configuration Manager 2012. The file is hashed, given an ID and sent only once. Each package is stored as pointers to the necessary files. This means that packages share files if they are the same. This saves on network usage and file storage requirements. Sounds awesome; doesn’t it!

Configuration Manager Layer

Here is an example:

I created two packages:

1. 1.      Filezilla – package id HH00005
2. 2.      Notepad ++ - Package id HH00006

Each has psexec.exe, one of my favorite sysinternal tools. Note you can get it here at http://live.sysinternals.com

Next I “Distribute Content” in the CM2012 console to my distribution point.

Distribution Point Layer

When content is sent to the distribution point, it is stored by default on the largest available drive in a folder, sccmcontentlib. During the install you can set this location, however, you cannot configure the drive settings in the distribution point properties after installation completes.

The following folders get created:

• ·        Datalib = Data Library
• ·        Filelib = File Library
• ·        Pkglib = Package Library

DataLib

For each package that you distribute a corresponding package+id.version number folder and file will be created. For patches the folder will appear as the patch guid and application folders will appear as Content_guid

Now let’s look at the package HH00005.1 (Filezilla)

Each DataLib folder contains .ini file which includes important information for the actual file.

• ·        Attributes
• ·        Size
• ·        TimeModified
• ·        Hash

 Viewing the psexec.ini file in the HH00005.1 package folder:

A Hash value of F8DB… is found. The first four entries of this hash are important. This is the locater folder name for the actual binary file in the pkgLib folder.

Note

The default hashing algorithm for content is SHA-256

To find the file:

Filelib

The folder names have meaning. Each corresponds to a hash value in the FileLib folder. In the example of HH000005.1, psexec.exe.ini, the value was F8DB

Viewing the F8DB folder:

The hash value .ini contains a list of the type and references of which packages use this file. Notice that there are two packages that are listed. This is single instance storage. Any package/program/content/update that has this exact hash file requirement will use this file and location.

The actual file will be the hash with no extension. Copying and renaming the file to psexec.exe, I verified that is the psexec file:

SHA-256 hash value matches.

Now back to the HH00005 package. It contains the setup for FileZilla and psexec.

Note that the psexec.exe.ini file points to the F8DB filelib folder as I demonstrated above.

To summarize the Content Library, Single Content Storage and this review:

Both HH00005 and HH00006 CM2012 packages contain the file psexec.exe. The file is only sent once to the Content Library and stored as single instance. A SHA-256 hash value is used to track the unique file and the first four digits are used as a locator. When a client requests the download the files are assembled from the Content Library via single instance storage.

Now suppose you want to reconstitute an entire package from the sccmcontentlib folder. I created a basic vb.net application to assist me in this exercise.

Following each PkgLib file to the DataLib, I was able to regenerate all the files from the FileLib for any given package.

I hope my blog posting was helpful in providing an understanding the Content Library and the Single Instance Storage in Configuration Manager 2012.

by Howard Hoy - MCS Consultant - Portland Oregon

March 2012

Delegation of administration in SMS/SCCM/ConfigMgr has always been a challenge. I’ve never seen a company where there wasn’t some type of delegated administration when it comes to management of computers, both Desktop and Server. Many groups just don’t trust one another. This lack of trust leads to some very creative delegation solutions. I’ve seen some pretty creative and hard to support implementations. Usually these solutions are developed internally that start off small get adopted as the way of doing business. Thankfully with System Center 2012 Configuration Manager a new feature called Role-Based Administration (RBA) is included to make it easier to delegate and effectively permission administrative tasks.

First I would like to define “Delegation” and what that really means. The Bing dictionary list delegation as:

“condition of being given responsibility: the condition of being given to somebody else as a duty or responsibility”

Delegations that I normally encounter are in environments which have separate Desktop and Server support teams. Each team manages their assets with different standards, governance and processes that almost always are incompatible. “One Console to Rule Them All”  is generally the desire from those who own the corporate Microsoft spending points. I mean, that really makes logical sense right? However, throw logic out the window because that is not reality. Groups will go at great lengths to ensure that they are the only administrators capable of inflicting damage via a management platform. We’ve all read about the horror stories from misguided advertisements that cause many support people to be up all night fixing the issues..

One creative implementation that comes to mind while thinking about RBA was a hard core support team from [insert your favorite company] that had responsibility for assets across the globe. They had a massive amount of AD Security groups, DCOM, NTFS Permissions and custom MMC’s to lock out admins to a very granular level. They spent a ton of time supporting and fixing their delegated solution. The increased support for creative solution consumed a lot of their time. Nobody was thinking into the future about supporting their creative solution, rather they were more focused on just solving their immediate problem. Furthermore, turnover causes knowledge loss which can make supporting these creative solutions a nightmare.

Now System Center 2012 Configuration Manager and RBA enter the picture. This is an excellent way to provide a level of delegation of duties for a management platform across all Windows (yes there are others) assets. Is it an answer to all those creative and hard to support delegation ideas? No it is not! For example, you could not provide a role for an admin to not see a particular application, yet still have the ability to deploy it within the console. Yes, I’ve been asked that before. RBA is the ability to apply a strict set of governance and delegation with permissions for logically grouped functions. 

I use the following when consulting with my clients about RBA:

RBA provides Configuration Manager 2012 Administrators with a security model that provides the ability to assign and manage administrative permissions - Delegation. RBA is accomplished by using Security Roles, Security Scopes and Collections in Configuration Manager 2012. This controls Who, How, What, Which and Where Administrative tasks are performed. The Configuration Manager console further simplifies this process by showing ONLY a streamlined view that is customized to a given Role. This is sometimes referred to as “The Show Me” console.

 This is a simplified logical design diagram which layers the key concepts in RBA:

Layers

Configuration Manager Console Layer - Who

Any person who requires Administrative/Management functions within Configuration Manager 2012

Configuration Manager 2012 is managed from a console application which groups administrative tasks into logical workspaces. They are as follows:

• Assets and Compliance
• Software Library
• Monitoring
• Administration

The console application can be distributed to the administrator’s workstations so long as they have network access. Please see the Appendix for the Operating System support and Network Port requirements.

Note that an Administrator will only see the objects that they are allowed to see. The following layer sections describe how RBA is accomplished.

 Configuration Manager Site Layer – How

The Configuration Manager Site Layer consists of the infrastructure necessary to operate a functional System Center 2012 Configuration Manager environment delivering the RBA capabilities. Since this document focuses on RBA, no more details regarding the requirements for a functional environment are covered. For that you can read TechNet.

Configuration Manager Security Role Layer – What

Objects and Permissions (operations)

In Configuration Manager 2012, Security Roles are used to collectively group objects and permissions (operations) for assignment to an Administrator. Instead of an individual permission set on a single instance of object, the Security Role provides a single Role assignment to an administrator; reducing the overall complexity with permission management. An “object” in the Security Role is something that you want to manage access to and “permission” is the operational functions, such as Read, Modify and Delete.

For example you might have a requirement to create Roles for Server and Workstation administrators who should be limited to managing Configuration Manager Client Agent settings on their targeted assets.  To solve this requirement a Role would be created and permissions could be assigned (see Security Scopes in the next section).

1.  Client Agent Role

By default any Administrator assigned this Role would be able to change the settings on both the Server and Workstations. To limit the permissions specific Security Scopes are required to be configured. That will be covered in the next section.

Included are default built-in roles to cover some basic management separation:

 These roles can be copied and customized to fit many different sets of Role requirements.

Configuration Manager Security Scope Layer - Which

Specific permissions to specific instances

A Security Scope contains permissions to specific Configuration Manager instances. Unlike the Security Role, which grants rights at a class level such as “Modify”, a Security Scope is granular and defines which permission apply within an specific instance. Collectively, these instance permissions are assigned to a Security Scope and is used to limit administrative access to specific secured objects.

For example let’s review our Security Scope Roles defined in the previous section:

1. Client Setting Role

Each type, Server and Workstation Administrator must have the ability to manage specific Configuration Manager Agent Client settings for the targeted assets and would be added to the Client Setting Role.

To “limit” the administrator access two Security Scopes are defined:

1. Server Assets
2. Workstation Assets

In addition two Collections are defined and contain the targeted Assets:

1. All Servers
2. All Desktops

Next the All Servers client agent settings are assigned to the Server Assets Security Scope and the All Desktops are assigned Workstation Assets Security Scope.

Finally the new Security Scopes are assigned to the applicable administrators. This process would prevent a Desktop Administrator from changing the client settings for any asset in the Server Collection. The opposite applies to the Server Administrator.

Additional Scopes and Collections can be generated to create very granular Security Scopes. For example a Security Scope could limit a Server Administrator to a specific set of assets and only allow Application Management.

There is a default scope that is generated during the installation of Configuration Manager 2012. All objects (if applicable) must have a Security Scope assigned. It is important to note that this default security scopes does not follow new objects. Any new object has a scope that is based upon the administrator’s security scope which is creating the new object.

Configuration Manager Collection Layer - Where

Collections of assets

A collection is group of resources that can be managed. In Configuration Manager 2012 there are two types of collections, Device and User. A Device Collection is a group of devices and a User Collection contains users. Collections support the ability to “Include” or “Exclude” resources in other Collections. For example a collection All Desktops could be “Include” all devices in the All Systems collection and have an “Exclude” for any device in the All Servers Collection. This would create a collection with just all Workstations.

Scenarios that you might have:

• Workstation Admins Only
• Server Admins Only
• Vender Admin to Workstations Only
• Server Admins to Specific Region
•  Patching Admin to Servers

 Here are some links for more information:

http://technet.microsoft.com/en-us/edge/Video/hh709988

and one of my favorites:

http://technet.microsoft.com/en-us/library/gg682088.aspx