For those who have attended my sessions at MMS over the years I appreciate your support. Thank you very much.

I will be combining two topics this year, so please register early. Depending on space and the number of people who register early they may open up another session to split this out.

Again thank you for your support in advance.

UD-B340 System Center 2012 Configuration Manager SP1 Case Studies and Migration Experiences

Speaker(s): Rodney Jackson

Track(s): Unified Device Management

Session Type: Breakout Session

Product(s): Configuration Manager 2012

Discuss and review common case studies from the field. This session will help administrators avoid common challenges to help reduce productivity and down time. Common issues with migration, client reassignment, shared distribution points, migration SP1 changes, setup, deployment, software distribution, and many other related topics will be covered in this session.

I would like to personally thank everyone who attended, participated and showed me support for my session this year. I always consider it a privilege to present and meet so many wonderful people.

I am making this post to add a few updates and clarifications to my slides. If you downloaded the slides before Saturday please check back for these updates. SV-B207 Common Migration Blockers for Configuration Manager 2012

I added a link to this slide as a reference on which Shared Distribution Points are eligible for upgrade.

I updated the following slide as it may have been misunderstood that we do not support DPs on Windows 2003 SP2. That was not the message I was communicating. My slide left out the fact that Windows 2003 DPs required IIS and customer’s security policy did not allow for IIS to be installed on the current DPs(they were on Domain Controllers), therefore customer was waiting for Windows 2008 R2 builds.

https://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SiteAndRoleScale

The following slides were updated to include more details on changing the manifest locations for APP-V applications that have been migrated from Configuration Manager 2007.

This post is for the attendees of the Microsoft Management Summit 2010 in Las Vegas who attended my session, “BA21 - PFE Case Studies – PFE Configuration Manager Support Cases From the Trenches”.

I am posting the SAMPLE ONLY SCRIPT from the session presented by Jason Johnson. Please remember this is a SAMPLE ONLY AND IS NOT SUPPORTED.

MMS2010SampleScripts.zip

You might ask why is this important? Well if someone changes the permissions or a policy is applied to your server it will be extremely important to have a good idea of what has been changed. This is a good starting point.The information below is what I came up with so far.

IIS 7.0/IIS 7.5 Default Permissions

Currently there is no article outlining the default permissions for IIS 7.0 and 7.5 however I have put together the following guidelines for your reference.

• If you install Windows 2008 (not R2) by default it will install IIS 7.0 and you have to download the Webdav components.
• If you install Windows 2008 R2(R2 rocks) by default it will install IIS 7.5 and Webdav is part of Server Manager Roles(you just enabled it)
• I have some advisory information on WebDav for future installed. I provided my blog link that talks about WebDav in one of my previous blog posting  https://blogs.msdn.com/rodneyj/archive/2009/05/18/client-install-fails-when-connecting-to-windows-2008.aspx

New IIS Accounts :

· IIS_IUSRS (a new built-in group), as it replaces IIS_WPG and is already granted the minimum rights required to start up a worker process.

· IUSR built in account replaced the  IUSR_Machine Name

· Both of these accounts are granted the minimum rights required to start up a worker process.

· Do not modify these accounts.

Understanding the Built-In User and Group Accounts in IIS 7.0

https://learn.iis.net/page.aspx/140/understanding-the-built-in-user-and-group-accounts-in-iis-70

Policies and Security Settings:

I Installed SQL 2008, Windows 2008 R2, Webdav, SCCM 2007 SP2 and highlighted a few changes:

Local Users and Groups

Default Membership is listed below:

“Users” Membership:

• Administrator
• Guests

“Group”  Membership:

Hope this helps.

Problem:

SCCM 2007 SP1 Client Installation Fails W/ WEBDAV Error in the ccmsetup.log when connecting to Windows 2008 Server

Failed to successfully complete HTTP request. (StatusCode at WinHttpQueryHeaders: 405) ccmsetup 1/28/2008

Action Taken:

1.IIS 7.0 was removed and reinstalled

2.Verified the Webdav settings via IIS Mgr

3. Client can connect to CCM_Client share on site server

4.Reviewed IIS logs and noticed error 405

2009-01-22 20:14:54 10.12.12.1 GET /CCM_Client/ccmsetup.cab - 80 -

10.12.100.30 ccmsetup 200 0 0 0

2009-01-22 20:14:54 10.12.12.1 PROPFIND /CCM_Client/ClientPatch - 80 -

10.12.100.30 ccmsetup 405 0 0 0

5.Researched error 405 and PROPFIND

PROPFIND is a WEBDAV method…more information

https://msdn.microsoft.com/en-us/library/aa142960(EXCHG.65).aspx

The WebDAVPROPFIND Method retrieves properties for a resource identified by the request Uniform Resource Identifier (URI). The PROPFIND Method can be used on collection and property resources

6.Looked up WebDAV error status codes: https://msdn.microsoft.com/en-us/library/aa126058(EXCHG.65).aspx

Based on this information we have to figure out what is not allowing this method.

7.Where do we restrict or configure the PROPFIND Method?

8.Researched the PROPFIND Method and located sample request and response on MSDN: https://msdn.microsoft.com/en-us/library/aa142960(EXCHG.65).aspx

9.Compared applicationhost.config file on this server with a working installation of Windows 2008 with IIS 7.0 in lab

Cause/Explanation:

Discovered that the applicationhost.config file was missing the following line highlighted in RED below.

webserver section

</system.webServer>:

<add name="WebDAV" path="*"

verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK"

modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />

Resolution:

1.Stopped the IIS Service

2.Added that line into the applicationhost.config file

3.Restarted IIS

4.Attempted to Reinstall Client

5.Client Installation was successful

ApplicationHost.config Diagram

At the root level we have a file called ApplicationHost.config (settings for Activation Service) that lives in the same directory of IIS (typicallywindows>
\System32\InetSrv\ directory).

This is the main configuration file for IIS, this is where we store things like the list of sites, applications, virtual directories, general settings, logging, caching, etc.

MMS 2009 is approaching and I have the great task of presenting a session titled, “SCCM 2007 Case Studies” again for the 4^th year in a row.

I understand the value of community input so I would like to get involvement from the communities such as myitforum, MVPs, etc.

Your help in advance will be invaluable to the success of this session.

How Can The Community Help?

I am looking for areas of interest from the community such as SCCM 2007 Post SP1 issues, OSD, AI, Software Updates, etc.

Please email me at rodneyj@microsoft.com

Thank you for time and help in advance. 

PROBLEM:

• Hardware Inventory not being updated for several SMS clients but Software inventory data is up-to-date.
• 10 clients all reporting to the same SMS 2003 SP2 Primary Site server and Management Point.
• Half (5) of the clients are only returning software inventory.
• Half of the client (5) are returning both hardware inventory and software inventory.

TROUBLESHOOTING:

1. Reviewed the InventoryAgent.log in the Windows\system32\ccm\log folder from one of the clients not reporting hardware inventory

 Inventory: Successfully sent report. Destination:mp:MP_HinvEndpoint, ID: {2B5ED4EC-4F6F-4184-8FC3-3EE38BBCDAB1}, Timeout: 80640 minutes

The InventoryAgent.log file states that the operation was successful

2. Reviewed the CCMExec.log

            OutgoingMessage(Queue='mp_mp_hinvendpoint', ID={2B7C0956-B1EA-474D-B1D8-EC8484582B2A}): Started upload to 'https://SMSSERVER/CCM_Incoming/{2B7C0956-B1EA-474D-B1D8-EC8484582B2A}'.       CcmExec  3/21/2007 12:46:32 seconds. CcmExec  3/21/2007 12:46:37 PM              4708 (0x1264)

            OutgoingMessage(Queue='mp_mp_hinvendpoint', ID={2B7C0956-B1EA-474D-B1D8-EC8484582B2A}): In pending state, will retry in 300 seconds.                  CcmExec  3/21/2007 12:48:07 PM              4708 (0x1264)

The CCMExec.log file will show that the operations is constantly retrying to place the Hardware Inventory file on the Management Point

3. MPFDM.log & Dataldr.log file never show the Hardware inventory file from the MP_Hinvendpoint is placed on the MP.

The .msg files are located in the C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint 

4. I could NOT ping the NetBIOS name of the SMS 2003 SP2 primary site server from the clients that is reporting ONLY software inventory
C:\ ping SMSServer

Ping request could not find host SMSSERVER. Please check the name and try again.

Could ping the NetBIOS name of the SMS 2003 SP2 primary site server from the clients that is reporting both hardware and software inventory

The only difference was the dns.microsoft.com DNS suffix setting was not configured on the SMS client ONLY reporting Software Inventory.  

EXPLANATION:

• By default we use DNS to connect to MP when the files are over 100k.
• A Design Change Request has been filed to allow the client to revert back to NETB IOS name.
• Software inventory usually report because the files are small; hardware inventory can fail when the files are larger than 100k and you are not using the DNS suffix as the workaround.

RESOLUTION:

•  Change the client DNS suffix

I introduced a new tool at MMS 2007 during my session called TRSCLEAN to reduce the size of large TRS files created by the issue outline in Microsoft Knowledge Base Article titled, “You experience a performance problem in Replication Manager of System Management Server 2003, https://support.microsoft.com/kb/926617. "

For information please review my previous blog posting. Today I want to give you some important information about using the TRSCLEAN tool and "-f" switch. I would also like to give credit to the developer of this tool (Franck Michou a Escalation Engineer at Microsoft). Thank You for sharing with the community.

This was a case I covered at MMS 2007 in San Diego, CA which has generated a lot of interest. I have received many follow up emails and inquiries for more information, therefore this will be my first case study blog.

Company Profile

Company B

SMS2003 SP2

120 Sites (primary and secondary)

3 – Tier Hierarchy

Problem

After a recent upgrade to SP2 TRS files increase by 70% in size.  In large environment with many SMS sites this can affect site server performance.

The side effect of this problem is replication manager  will suffer a performance degradation as the TRS files grow larger creating a backlog of files in the sms\inboxes\replmgr.box.

Explanation

·         This is a known issue and can happen during an upgrade or package source update cycle.  An upgrade or package source update cycle may not be the actual cause but are just triggers that can cause this problem.

·         The hotfix will prevent future growth of the TRS files.

·         The hotfix does not reduce the current size of the TRS file. It only prevents future growth.

·         TRS files are transaction files which keep a record of serial numbers, package ids and site control changes from site-to-site. For example when you create a package the package ID number is recorded in the database and a transaction ID that corresponds to that id is record in the TRS file.

·         Here is an example of what a TRS file with duplicate entries would look like. If you open the TRS file you can find the following section.

[PKGSTATUSDATA] section:

ABC|["DISPLAY=\\SMSSERVER\"]MSWNET:["SMS_SITE=ABC"]\\SMSSERVER\|2=1343

ABC|["DISPLAY=\\SMSSERVER\"]MSWNET:["SMS_SITE=ABC"]\\SMSSERVER\|2=1345

ABC|["DISPLAY=\\SMSSERVER\"]MSWNET:["SMS_SITE=ABC"]\\SMSSERVER\|2=1346

Prerequisite For Hotfix

You must be currently running SMS 2003 SP2

The hotfix only works with sites already running SP2

Who should apply the hotfix?

1.       First, anyone who manages a large environment and notices the size of the TRS files size seems larger than normal.

2.       Second, you are experiencing a significant decrease in performance on the server and it takes you a long time to open the sms\inboxes\replmgr.box\history folder.

3.       Third, anyone who has a large environment with multiple sites should probably consider applying the hotfix even if performance is not an issue right now, because the hotfix with prevent the TRS files from growing.

What can you do to reduce the size of the TRS files if they are large?

Use the TRSCLEAN.EXE tool to reduce the current size

Step by Step Resolution

1.       Run the SMS Backup Task to backup  the SMS site

2.       Stop the SMS Executive & Site Component Manager Services

3.       Apply Hotfix, “You experience a performance problem in Replication Manager of Systems Management Server (SMS) 2003” https://support.microsoft.com/kb/926617

4.       Run TRSCLEAN w/ (must include –f switch to remove extra space in TRS file) to reduce size of TRS file. You can also run the TRSCLEAN.exe /? With the help switch for more information.  In the example below I run the TRSclean.exe against my ABC site without the extension in offline mode.

 C:\ >trsclean/?

TRSClean - Clean SMS 2003 .TRS
TRSClean [-a]|[-t CSC] [-o] [-f] [-v]
-a       All sites reporting to this site
-t CSC   Specific Child Site Code (3 bytes, uppercase)
-o       Offline mode (no WMI access, removes duplicate records in [PKGSTATUSDATA] and unused sectio
ns)
-f       Update TRS for KB926617
-v       Verbose mode