Reporting on Visual Studio License, via System Center Configuration Manager 2012

I recently had a request to report on the number of Visual Studio installs in a customer environment. Honestly, the customer did not have a full understanding of how many and where it was installed. Luckily, the customer had System Center Configuration Manager 2012 installed, so this was a snap.

I was asked "Kevin, how can I report on where it is installed?"

Answer: "Simple, write a report that shows only what you want. What do you want?"

Next question: "Umm, machine name, version of Visual Studio, User and OS".

Next Answer: "Great, do these 8 steps…."

Step 1.    Goto your Configuration Manager Reports site: https://servername/Reports and click "Report Builder"

Step 2.    Create a Table Report:

Step 3.    Chose the dataset that matches your Configuration Manager install:

Step 4.    Click the "Edit as Text" and type in the following query. (See appendix for a copy and paste of the query)

Step 5.    Set the "ProductName" as the Row Group and all others as Values.

Step 6.    Resize the report and title it as you like.

Step 7.    Save the report (rdl file). I saved mine directly in the "Software – Companies and Products" folder in the System Center directory.

Step 8.    Simply run the newly published report to see the results. You can also export to Excel here to slice and dice as you wish.

Appendix:

select distinct P.DisplayName0 as ProductName,

    P.InstallDate0 as InstallDate,

    S.Netbios_Name0 as ComputerName,

    S.User_Name0 as LastUser,

    S.Operating_System_Name_and0 as OperatingSystem,

    S.Last_Logon_Timestamp0 as LastSeen

from [dbo].[v_Add_Remove_Programs] as P,

    [dbo].[v_R_System] as S

where

    S.ResourceID = P.ResourceID

    and

    (P.DisplayName0 like 'Microsoft Visual Studio %Premium%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Ultimate%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Professional%'

    or P.DisplayName0 like 'Microsoft Visual Studio %Express%' )

    and P.InstallDate0 is not null

order by S.Netbios_Name0

This is blog post from the work done by Kevin Saye...

Overview:

Unlike Windows clients and servers, Microsoft does not provide "Windows Update" for Apple products. This article discusses how to configure System Center Configuration manager 2012 SP1 to leverage the Apple "Software Update" feature to ensure that Macs are up to date, as defined by Apple.

How it works:

Using the Configuration Manager client for Mac and "Compliance Settings" (formerly called Desired Configuration Manager), we can configure "Windows Update" like functionality. The diagram below shows the components and dependencies. Notice how we use the client to check and verify updates with Apple's site directly, which is different from our architecture with Windows Update, where Configuration Manager talks (and downloads) updates from Windows Update.

The steps used by this solution are:

1. Configure Configuration Manager to support Mac clients.
2. Install the Configuration Manager 2012 SP1 client on the Mac.
3. Configure a Compliance Setting to check for updates and deploy to the All Macs Collection
4. The Configuration Item will check the update status (checks /tmp/softwareupdate.log).
   1. If the log file does not exist, it configures CRON and reports non compliance
   2. If the file exist:
      1. Check for "No new software available." In the log file.:
         1. If text exist = compliant
         2. If text does not exist = non-compliant

You can also configure a deployment that targets non complaint Macs, and the update can simply run the "/usr/sbin/softwareupdate" command with an install switch.

Setting it up:

For this article, I will assume you have the Configuration Manager Environment setup and the Mac client deployed. There are numerous TechNet articles that discuss this.

Configuring Compliance Settings:

1. In the Configuration Manager Console under Assets and Compliance -> Compliance Settings -> Configuration Items right click and select "Create Configuration Item". Name it "Mac OS Software Update Check" or the like and specify "Mac OS X" as they type and click next.

1. Select the Supported Platforms and click next.

1. Click New on the setting screen, name the setting "Check /tmp/softwareupdate.log" set the type to "Script" and set the data type to "String".

1. Click Add Script in the Discovery script section, and type the script as shown below. Click OK.

A few items of note:

• The echo lines that write to /etc/crontab contains tabs, not spaces.
• The echo lines that write to /etc/crontab is one line, even though the UI seems to word wrap it.
• I am applying the setting where we run softwareupdate every hour at 30 minutes past the hour, as evident by the 30 written to the crontab file, followed by asterisks.
• To get the script to work correctly, I typed it up in notepad (shown below) and just copied and pasted or click the open button.
• From a compliance checking perspective, all we care about is the last line. All the lines before it ensure that cron is running.

1. Click "Compliance Rules" on the top tab and then click "New" to create a compliance rule.

1. In the "Edit Rule" screen of the Compliance Rule:
   1. Name the rule Check for "No new software available."
   2. Set the setting to Contains and type the value No new software available.
   3. Check the Report noncompliance checkbox.
   4. Set the severity as Warning.
   5. Click OK.

1. Click OK to close the Create Settings screen and click Next 3 times and then Closed.
2. In the Configuration Manager Console under Assets and Compliance -> Compliance Settings -> Configuration Baselines right click and select "Create Configuration Baseline". Name it "Mac OS Software Update Baseline" or the like. Click Add to add the Configuration Item you just created named Check /tmp/softwareupdate.log.

1. Right click on the "Mac Software Update Baseline" and deploy it to your collection. Check the remediate and set this script to run every hour.

Seeing it in action:

To start with, we will look at a Mac without the baseline installed.

Notice that there is not a /etc/crontab file which is the default. Also, if I run the softwareupdate –l command, we see that there are 2 updates that are recommended.

Once I applied the Baseline, I can go to the client and click Connect Now, the baseline will be applied to my system.

Notice now that even though the baseline is applied, it is showing non-compliant because the /tmp/softwareupate.log file is missing. We are waiting on cron to run and check with Apple.

Once cron has run and the baseline has run, it shows me that my Mac is missing 2 recommended updates, which is what I wanted.

Lastly, once cron runs, the /tmp/softwareupdate.log file looks like this:

And Configuration Manager shows compliance:

This is a blog post from the work that Kevin Saye completed... 

Summary:

With the proliferation of consumer and non-enterprise devices on the corporate network, security and health of these devices is top of mind for security officers.

While there are many vendors out there who offer agent and appliance solutions, Microsoft has provided Network Access Protection (aka NAP) since Windows Server 2008.  With NAP, you can provide device level health for devices using the proven capability of: 802.1x (port level authentication), VLAN (network level segmentation) and client posture assessment for client devices.

This document outlines how to setup NAP for enterprise and consumer devices, allowing corporate and non-corporate access secure access.

Overview of Solution:

One of the most secure implementations of network protection is via 802.1x, which is a capability of most if not all enterprise level network gear (both wired and wireless).  NAP can use 802.1x as an enforcement point, providing end users ease of access and policy compliance with both enterprise and consumer devices.  This is where policy meets enforcement, and the end users just plug in a device (or connect via wireless) and magically it gets to the correct network.

For my demonstration, I used HP Procurve switches with the latest firmware.  With this firmware, the commands changed just a bit from Jeff’s 2008 blog post here (https://blogs.technet.com/b/nap/archive/2008/06/19/nap-802-1x-configuration-walkthrough.aspx).

For this solution, there are 3 types of devices: enterprise managed, 802.1x capable and other (insert your favorite device here).

For enterprise managed (joined to the domain), they have the correct configuration, client certificate and policy compliance that enables it to be on the corporate network.  For the other 2, they are “restricted” to the guest network protecting sensitive data / systems from insecure systems.

To outline the solution, consider the diagram below, showing the logical flow and dependencies of a NAP solution using 802.1x.

Setting it all Up:

HP Switch:

The following settings are for an HP Procurve switch with a F.05.77 firmware.

vlan 1

; this VLAN is not used

 name "DEFAULT_VLAN"

ip address dhcp-bootp

exit

vlan 243

; this VLAN is my internet only VLAN  

name "243"

; Port 1 is my uplink port

tagged 1

exit

vlan 184 

; this VLAN is my corporate VLAN

name "184"

; Port 1 is my uplink port, port 2 is my non NAP port.

tagged 1

ip address 10.7.184.250 255.255.255.0

exit

; This enables EAP, sets the NPS server and the shared secret, sets ports 2-24 to use 802.1x and activates it

 aaa authentication port-access eap-radius

radius-server host 10.7.184.200 key secret

aaa port-access authenticator 2-24

aaa port-access authenticator 2-24 unauth-vid 243

aaa port-access authenticator active

This configuration uses port 1 as my uplinked, which is VLAN tagged for both VLAN 184 (corporate VLAN) and VLAN 243 (internet / Guest VLAN).

I am also using EAP authentication, as this is the most secure this switch provides.

The IP address of my NPS is 10.7.184.200 and the shared secret is “secret”.  The HP switch does not forward request for non 802.1x capable devices, but instead it uses the “unauth-vid” setting to define VLAN 243 for them.

I am also using EAP authentication, as this is the most secure this switch provides.

NPS Server:

For the NPS server, I followed these summarized steps.

Step 1: After installing the Network Policy Server, select NPS (Local) and click “Configure NAP”.

Step 2: Select the connection method to be 802.1x wired.

 Step 3: Add one or more of your switches (HP in my case).

Step 4: Determine what users or machine groups you want to allow connections to the corporate VLAN.

Step 5: Select the NAP Server certificate (if allowing non domain machine, it should be a public PKI cert), and the EAP type.  For my environment, I wanted machine certs, so I used EAP-TLS.  You could have had the users type in a password (PEAP), but that is not the experience I wanted.

Step 6: Define the VLAN attributes for the corporate VLAN (aka the compliant network / full access network)

Step 7: Define the VLAN settings for the guest VLAN (aka the non-compliant / restricted network)

Step 8: Define which validators you will use, if remediation is enabled and what to do with non-NAP computers.

Step 9: Lastly, I setup my Windows Security Health Validator to match my policy.

Client Device – Enterprise Managed:

On enterprise managed devices, you need to set at least 4 settings.  These can all be set via GPO, but I wanted to show the exact settings here so you can fully understand what has to be set.

Step 1: Set both the “Network Access Protection” and the “Wired AutoConfig” service as automatic and start them.

Step 2: Open up an MMC, add the “NAP Client Configuration” and enable the EAP Quarantine Enforcement Client.

Step 3: Once the “Wired AutoConfig” service is started, in network connections right click on the Ethernet interface and select Authentication.  Enable 802.1X and select PEAP.

Step 4: Click Settings of EAP, select “Validate server cert” and select your CA.  Next set the Authentication method to “other certificate”.

Client Device – 802.1x capable not Enterprise Managed:

An 802.1x client, not completely configured, including not having a valid certificate, it automatically placed on the guest network.

Client Device – non 802.1x capable:

Non 802.1x capable devices are placed on the guest network.

Seeing it in Action:

Enterprise Managed:

Enterprise Managed Devices just connect as expected and without any noticeable change.

The network card looks normal (as a point of reference)

And if you run napstat.exe, you see the status of the machine.  Notice how I changed the title, description and the image, you can too!

Other – 802.1x not configured:

On devices with 802.1x but misconfigured you will see the network card attempt to authenticate, but eventually fail.  In the failed state, the will be on the guest network.  If you change the NPS authentication from EAP certificate only, to something else, the use can get an authentication prompt and attempt to authenticate as the user. Not the experience I wanted, from a usability perspective.

Other – non 802.1x:

On devices without 802.1x, they will remain in a failed state, but the UI does not show this status.  This device will be on the guest network.

HP Switch:

From the switch console, you will see that I have a device on port 4 that is nap capable and is on the VLAN 184.  The device on port 3 is either not nap capable or not compliant and as such is on VLAN 243.

Auditing the Events:

You will see one of two type of audit logs, by default.

Success:

In the security log on the NAP server, you will see event 6278 with a success code as shown below:

Actual content:

Network Policy Server granted full access to a user because the host met the defined health policy.

User:

     Security ID:               KEVINSAY\MTC71$

     Account Name:              KEVINSAY\MTC71$

     Account Domain:            KEVINSAY

     Fully Qualified Account Name:   KEVINSAY\MTC71$

Client Machine:

     Security ID:                    NULL SID

     Account Name:                   mtc71.kevinsay.pvt

     Fully Qualified Account Name:   KEVINSAY\MTC71$

     OS-Version:                     6.1.7601 1.0 x64 Workstation

     Called Station Identifier:      00-30-c1-a9-d7-a4

     Calling Station Identifier:     88-51-fb-c9-36-fa

NAS:

     NAS IPv4 Address:     10.7.184.250

     NAS IPv6 Address:      -

     NAS Identifier:            HP ProCurve Switch 2524

     NAS Port-Type:             Ethernet

     NAS Port:                 4

RADIUS Client:

     Client Friendly Name:      HP Procurve

     Client IP Address:              10.7.184.250

Authentication Details:

     Connection Request Policy Name: NAP 802.1X (Wired)

     Network Policy Name:            NAP 802.1X (Wired) Compliant

     Authentication Provider:        Windows

     Authentication Server:          NAP.kevinsay.pvt

     Authentication Type:           PEAP

     EAP Type:                       Microsoft: Smart Card or other certificate

     Account Session Identifier:          -

Quarantine Information:

     Result:                         Full Access

     Extended-Result:                -

     Session Identifier:             {DDA6D86C-E54C-4913-9E74-4E00B95F54FA} - 2013-05-14 17:19:27.053Z

     Help URL:                       -

     System Health Validator Result(s):  

Windows Security Health Validator

     0

     Compliant

     No Data

     None[]

     (0x0 - )

     (0x0 - )

     (0x0 - )

     (0x0 - )

     (0x0 - )

     (0x0 - )

     (0x0 - )

     (0x0 - )

Failure:

In the security log on the NAP server, you will see event 6273 with a failure code as shown below:

Network Policy Server denied access to a user. 

Contact the Network Policy Server administrator for more information.

User:

     Security ID:                    NULL SID

     Account Name:                   mtcvaioexec\mtcadmin

     Account Domain:                 MTCVAIOEXEC

     Fully Qualified Account Name:   MTCVAIOEXEC\mtcadmin

Client Machine:

     Security ID:                    NULL SID

     Account Name:                   -

     Fully Qualified Account Name:   -

     OS-Version:                     -

     Called Station Identifier:      00-30-c1-a9-d7-b0

     Calling Station Identifier:     54-42-49-97-42-8d

NAS:

     NAS IPv4 Address:          10.7.184.250

     NAS IPv6 Address:          -

     NAS Identifier:            HP ProCurve Switch 2524

     NAS Port-Type:             Ethernet

     NAS Port:                 3

RADIUS Client:

     Client Friendly Name:      HP Procurve

     Client IP Address:         10.7.184.250

Authentication Details:

     Connection Request Policy Name: NAP 802.1X (Wired)

     Network Policy Name:       -

     Authentication Provider:        Windows

     Authentication Server:          NAP.kevinsay.pvt

     Authentication Type:            PEAP

     EAP Type:                       Microsoft: Smart Card or other certificate

     Account Session Identifier:          -

     Logging Results:                Accounting information was written to the local log file.

     Reason Code:                    7

     Reason:                         The specified domain does not exist.

• Mac OS X 10.6 (Snow Leopard)
• Mac OS X 10.7 (Lion)
• Mac OS X 10.8 (Mountain Lion)

The following scenarios are supported through the Mac client in Microsoft System Center 2012 Configuration Manager SP1:

• Discovery – Discovers Mac OS X system in Active Directory and through network discovery
• Hardware Inventory – Provides hardware inventory and auditing of computers running Mac OS X, including a list of installed software similar to add/remove programs for Windows systems.  
• Settings Management – Ensures computers running Mac OS X comply with company policies using scripts and preference list management.
• Application Deployment – Distributes required software via app model.
• Software Updates Management – Distributes patches utilizing Software Distribution and Settings management features.

You can download the Mac Client from - https://www.microsoft.com/en-us/download/details.aspx?id=36212 

Supported configurations and hardware requirements for Mac: See the Client Requirements for Mac computers section in the Supported Configurations for Configuration Manager topic. https://technet.microsoft.com/en-us/library/gg682077.aspx 

Mac Client Installation:

1. Download the Mac client msi file to a Windows system
2. Run the msi and it will create a dmg file under the default location “C:\Program Files (x86)\Microsoft\System Center 2012 Configuration Manager Mac Client” on the Windows system
3. Copy the dmg file to a network share or a folder on a Mac computer
4. Access and open the dmg file on a Mac computer and install the client using instructions in the online documentation. https://technet.microsoft.com/en-us/library/jj591553.aspx

A laptop in tablet form, Surface Pro brings together the best of Microsoft in one awesome new device.

Here are the specifications: 

An update is available that adds support for Windows 8-based client computers in Microsoft System Center Configuration Manager 2007 Service Pack 2 (SP2).

Additionally, this update adds Windows 8 and Windows Server 2012 to the supported platform list in the following features:

• Software distribution
• Software update management
• Desired Configuration Management (DCM)

This update also fixes the following issues:

• Discovery Data Manager (DDM) does not create Client Configuration Requests (CCRs) for Windows 8-based computers that are discovered by using the Active Directory System Discovery.
• When the system processes a new power profile, the SMS Agent Host service (Ccmexec.exe) or the WMI Provider Host service (Wmiprvse.exe) stops unexpectedly.

• Microsoft Windows .NET Framework 4.5. This eliminates the Microsoft Windows .NET Framework 4 requirement.
• Windows PowerShell 3.0
• Update for Windows KB2533623

I first enabled the Quick Fix Engineering Inventory Class, then I created a Configuration Manager 2012 Application and used the following PowerShell query to Detect if Update for Windows KB2533623 is installed.

Get-WmiObject Win32_QuickFixEngineering | where {$_.HotFixID -eq "KB2533623"}

This worked great until KB2567680 was released and superseded KB2533623 so I had to update my Detection Script to the following:

Get-WmiObject Win32_QuickFixEngineering | where {$_.HotFixID -eq "KB2533623" -or $_.HotFixID -eq "KB2567680"}

I then set the Update as a Dependency for the App-V 5.0 Client Deployment.

UE-V 1.0 (https://go.microsoft.com/fwlink/?LinkId=267626)

Microsoft Application Virtualization (App-V) provides the administrative capability to make applications available to end user computers without installing the applications directly on those computers.

App-V 5.0 - (https://go.microsoft.com/fwlink/?LinkID=271502)

App-V 4.5 and 4.6 - (https://go.microsoft.com/fwlink/?LinkId=232982)

SoftGrid - (https://go.microsoft.com/fwlink/?LinkId=232981)

App-V Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=231902)

Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption.

MBAM (https://go.microsoft.com/fwlink/?LinkId=217222)

MBAM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=231905)

Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based desktops.

DaRT 8.0 supports Windows 8 and Windows Server 2012.

DaRT 7.0 supports Windows 7 and Windows Server 2008 R2.

DaRT 6.5 supports Windows 7 and Windows Server 2008 R2.

DaRT 6.0 supports Windows Vista and Windows Server 2008.

DaRT 5.0 supports Windows 2000, Windows XP, and Windows Server 2003.

Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide change control and improved management.

Overview of Microsoft Advanced Group Policy Management - (https://go.microsoft.com/fwlink/?LinkId=232980)

AGPM Whitepapers on the Microsoft Download Center - (https://go.microsoft.com/fwlink/?LinkId=232275)

AGPM 4.0 supports Windows Vista SP1, Windows 7, Windows Server 2008, and Windows Server 2008 R2.

AGPM 3.0 supports Windows Vista SP1 and Windows Server 2008.

AGPM 2.5 supports Windows Vista and Windows Server 2003

Asset Inventory Service (AIS) reduces application management lifecycle cost of ownership by scanning and translating inventory data into useful, readable information.

AIS Online Help (https://go.microsoft.com/fwlink/?LinkId=226726)

Microsoft Desktop Enterprise Monitoring (DEM) monitors and reports enterprise-wide desktop application and system failures.

DEM 3.5 (https://go.microsoft.com/fwlink/?LinkId=232985)

DEM Whitepapers on the Microsoft Download Center - (https://go.microsoft.com/fwlink/?LinkId=232276)

 Microsoft Enterprise Desktop Virtualization(MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization.

MED-V 2.0 supports Windows 7.

MED-V 1.0 supports Windows Vista and Windows XP.