Scott’s Blog https://docs.microsoft.com/archive/blogs/scott/feed.xml Managing and Deploying Windows with Configuration Manager and the Cloud. Tue, 16 Apr 2019 06:16:21 GMT en-US hourly 1 Office 365 ProPlus Deployment - We found a problem - Configuration Manager 1702 https://docs.microsoft.com/archive/blogs/scott/office-365-proplus-deployment-we-found-a-problem-configuration-manager-1702 Tue, 19 Sep 2017 17:29:09 GMT https://blogs.technet.microsoft.com/scott/?p=425 Office 365 ProPlus - We found a problem[/caption] Clicking on the link takes you to a page on Office Support about error code  30053-4 or 300353-39. The likely cause of this error is a bug in the wizard if you are logged into a computer where the language is set to an English language other than English (United States), the wizard will enter the language code for the unsupported language into the XML file. The Office Deployment Tool supports downloading Office in the following languages: https://technet.microsoft.com/EN-US/library/cc179219(v=office.16).aspx. [caption id="attachment_445" align="aligncenter" width="500"]Office 365 Installer English Australia Office 365 Installer - English (Australia)[/caption] If you try to edit the language in the wizard, you'll get an exception with the text "unhandled exception has occurred in your application, the given key is not present". [caption id="attachment_435" align="aligncenter" width="500"]Office 365 Installer Console Exception Office 365 Installer - Console Exception[/caption]

Solution

This particular bug has been fixed in Configuration Manager, version 1706 which is now available for general release. The code has been fixed so that if an unsupported language is selected, the wizard will default to English (United States).

Workaround 1 - Change Windows Display Language

If you don't have the luxury of upgrading the newest version of Configuration Manager just yet, you change your display language to English (United States) and restart the console. [caption id="attachment_455" align="aligncenter" width="300"]Settings - Language English (United States) Settings - Language English (United States)[/caption] When you try again, you'll notice the wizard has English (United States) selected and you can add/remove additional languages without causing a console exception. [caption id="attachment_475" align="aligncenter" width="500"]Office 365 Installer English (United States) Office 365 Installer - English (United States)[/caption]

Workaround 2 - Download Manually

You can always download Office 365 ProPlus using the Office Deployment Tool and create the application manually. To get started, see Using the Office Deployment Tool for Click-to-Run.]]> Boundary Group Validation Script - Configuration Manager https://docs.microsoft.com/archive/blogs/scott/boundary-group-validation-script-configuration-manager Thu, 14 Sep 2017 16:12:03 GMT https://blogs.technet.microsoft.com/scott/?p=385 https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/boundary-groups. Finding clients that do not have a valid location to download content from can be challenging depending on the size or complexity of an environment. As a result, I've created a script that helps an administrator review their configuration and hopefully identify clients that are in a boundary that provides them with content. The script has been through a few iterations, and can now successfully validate boundaries based on:
  • Active Directory site;
  • IP Subnet;
  • IP Range, or;
  • IPv6 Prefix.
The script prompts for and connects to a site server and checks the information recorded for each client to verify that either it's Active Directory site name, or one of it's IP addresses results in it being a member of a Boundary Group with a Site System listed.

Script Details

This section details how the script works.

Results if all Clients are Covered by a Boundary Group

Figure 1 displays the script results if all clients are detected as being covered by a Boundary Group. [caption id="attachment_395" align="alignnone" width="500"]All clients are covered by a Boundary Group Figure 1 - All clients are covered by a Boundary Group[/caption]

Results if Some Clients are not Covered by a Boundary Group

Figure 2 shows the script results when some clients are not covered by a Boundary Group. [caption id="attachment_405" align="alignnone" width="498"]Some clients are not covered by a Boundary Group Figure 2 - Some clients are not covered by a Boundary Group[/caption] The script will also pop a window (Figure 3) that displays a list of computers and their IP addresses that are not covered by a Boundary Group. [caption id="attachment_415" align="alignnone" width="501"]All clients not covered by a Boundary Group Figure 3 - All clients not covered by a Boundary Group[/caption] The results are exported to a file called BoundaryGroups.csv in the temp directory (%temp%).

BoundaryGroups.csv

The CSV file outputs the following columns:
Column Name Description
BoundaryCount The number of Boundaries detected for this client
CoveredByBoundary True if the client has any Boundary found
Type The type of Boundary checked (IP range, AD Site, Iv6 Prefix, IP Subnet)
IP The IP address checked (if relevant)
GroupNameContent The Boundary Group name detected that has a site system
SiteCode The site code listed if the Boundary Group is configured as a Site Assignment Boundary.
Value The detected or suggested Boundary value (AD Site name, IP Subnet or IP address range)
Name The name of the Boundary if detected
DPs How many DPs the client has access to
GroupNameSiteOnly The name of the Boundary Group if it's used for Site Assignment
CoveredByBoundaryGroup True if the client is covered by a Boundary Group that also has a site system in the references tab.
  If you are opening the CSV file in Excel and want to just list possible boundaries for a client that does not have a Boundary Group with a site system - filter the Covered by Boundary Group column to "not true". You'll notice multiple entries for each client, that's because it provides you with the information you'd need to create an appropriate boundary depending on your preference. Could be that you select AD Site, which should be listed.

Script Download

You can download the script from TechNet gallery, here: https://gallery.technet.microsoft.com/Validate-Boundary-Group-d85ed496.

Summary

This script is provided as is with no warranties. I recommend running it on your PC and connecting remotely to the Configuration Manager server rather than running it on the Configuration Manager server as it stores client and boundary information in memory while running. If computers are connected over VPN or DirectAccess, some of the IP addresses listed (and collected by Configuration Manager) might include private addresses of home networks. So keep that in mind when you are looking to create boundaries and ensure you check with your network teams. Please comment below if you have any feedback or questions.]]> Collection Evaluation Overview - Configuration Manager https://docs.microsoft.com/archive/blogs/scott/collection-evaluation-overview-configuration-manager Wed, 13 Sep 2017 21:46:49 GMT https://blogs.technet.microsoft.com/scott/?p=325 Figure 1 - High-Level Collection Update Process[/caption]

Hierarchy Considerations

A ConfigMgr environment may have one or more sites based on requirements.  There are three types of sites that can be created:
  • Central Administration Site (CAS) which sits at the root level of the ConfigMgr environment. This site does not manage clients but does manage lower level sites.
  • Primary Sites sit immediately below the CAS and receive instructions replicated from the CAS database on which they act. Primary Sites manage clients and are the only site that evaluates collections.
  • Secondary Sites sit below a primary site and act as a proxy for that primary site. Data on the secondary site is exclusively populated using replication from the associated primary site.  Secondary sites do not evaluate collections.
Given that a CAS does not evaluate collection membership, it needs to send a request to each primary and request a collection update. The primary sites evaluation the collection update and send the results back to the CAS. Figure 2 demonstrates an administrators experience when requesting a manual collection update. [caption id="attachment_365" align="aligncenter" width="499"]Administrator Experience During a Manual Collection Update from a CAS Figure 2 - Administrator Experience During a Manual Collection Update from a CAS[/caption]

Collection Evaluation Types

Collection evaluation is handled by different threads depending on the type of evaluation. These threads are:
  • Primary – when a collection update is scheduled;
  • Auxiliary – when a manual collection update is triggered for a collection with dependent collections;
  • Single – when a manual collection update is triggered for a collection with no dependent collections;
  • Express – processes incremental collection evaluation.
Table 1 describes the collection evaluation triggers:
Trigger Description
Manual This is the highest priority collection evaluation.  If an administrator chooses to perform a manual collection evaluation, then the next evaluation thread that becomes available will be assigned to a manual evaluation.
Scheduled The process of scheduled evaluation is identical to that of manual evaluation with the exception of course that the evaluation is now not event-driven but time-driven.
Incremental Incremental Collections are a collection evaluation schedule that is similar to the Delta collection updates that were possible in ConfigMgr 2007. In ConfigMgr 2007, delta updates only added resources to a collection when the device was initially discovered. So if a collection query was based off information that would only be updated later (i.e. hardware inventory), then the resource would only be added to or removed from a collection during a scheduled collection update. In ConfigMgr 2012, incremental collections work as administrators expected in ConfigMgr 2007. Any update to a resources objects are monitored and updated in collections configured for incremental updates. Incremental evaluation uses a collection evaluation graph to evaluate and update dependent collections if an update to the incremental collection membership changes.
Staging Since ConfigMgr 2012, all the collections should be dependent on All Systems or All Users and Groups directly or indirectly. Both of these collections perform a full collection evaluation at 4:00 AM every day. As per the full evaluation cycle, if a change occurs to either of these collections it will trigger updates of dependent collections based on a Full Collection Graph (explained later).
Table 1 – Collection Evaluation Types

Evaluation Process

As each individual collection is evaluated, the following steps are performed:
  1. Execute each collection query
  2. Add any systems which are direct members
  3. Evaluate all Include collections.
  4. A logical AND is performed between this list and the limiting collection.
  5. The exclude collections are then evaluated.
  6. The results of this step are then logically OR’d against the result set above.
  7. The changes are then either written to, updated or deleted from the database.
  8. Trigger any dependant collections to update as well (collections that refer to this collection using an include rule, and exclude rule or collections that are limited to this collection)

Collection Evaluation Graph

The collection evaluation graph is a new concept since ConfigMgr 2012. Previously in ConfigMgr 2007 a collection evaluation was an isolated event resulting in updates only to the targeted collection. In ConfigMgr 2012 a collection evaluation involves the targeted collection and any related collections. The collection evaluation graph is built differently based on the type of collection evaluation being performed. It is important to understand the different ways in which collections will be evaluated so that appropriate collection design decisions can be made. In general, there are 2 types of evaluation graphs that are built by ConfigMgr;
  • Incremental, or;
  • Full.
When collection evaluation starts ConfigMgr will build a graph which will include all collections which could possibly need evaluating as a result of changes to the relevant collection. The collection evaluator then builds all of these into the Collection Evaluation Graph starting from the highest level within this cycle.  It will then start to move through the graph in order evaluating each collection membership in turn.  When the collection has been evaluated then any collections below which would NOT be affected by this collection evaluation cycle are removed from the evaluation graph. If one or more of the collections being evaluated has an Include or an Exclude rule then the collection being included or excluded will also have been added to the graph together with any collections limited by that collection.  During the evaluation of the include and exclude collections should there be any changes then the graph will continue on that branch before returning to the main branch. During an incremental collection evaluation, the collection evaluation graph will only map referencing collections if they are enabled for incremental evaluation. If an incremental collection is limited to a collection that is not enabled for incremental evaluation, it will be evaluated based on the existing membership of the limiting collection. For example, in Figure 3 even though there are newly discovered resources applicable to all collections, only All Servers and All Servers with Windows Server 2008 R2 are updated while the other collections are not evaluated because the All Servers with Windows Server 2012 R2 collection is not enabled for incremental evaluation. [caption id="attachment_366" align="aligncenter" width="580"]Incremental Collection Evaluation Graph Example Figure 3 - Incremental Collection Evaluation Graph Example[/caption] When a collection evaluation is triggered manually or based on a schedule, a full collection evaluation graph is built of all dependent collections. All collections that reference the collection that is updating or subsequent collections are included. ConfigMgr will continue to evaluate down the graph as long as updates to the collections being processed occur. Figure 4 demonstrates how the collection evaluation graph includes all applicable collections when a scheduled or manual collection update request is made for the All Servers collection. In the example, 2 new DNS servers running Windows Server 2008 R2 and Windows Server 2012 R2 have been discovered since the last collection evaluation. The two new resources are in scope of the membership queries of all collections shown resulting in all collections updating. [caption id="attachment_367" align="aligncenter" width="580"]Full Collection Evaluation Graph Example Figure 4 - Full Collection Evaluation Graph Example[/caption] Conversely, Figure 5 demonstrates that not all collections are always evaluated during a full evaluation. The collection evaluation graph will only continue to evaluate dependent collections if an update occurs to the corresponding referenced collection. In the example, the installation of DNS on the Windows Server 2012 R2 server would make it a member of the All Windows Server 2012 R2 Servers with DNS Server collection, however because no update occurred to its limiting collection the collection is not evaluated during this evaluation. It would be evaluated during the next incremental evaluation cycle (because it is an incremental collection). [caption id="attachment_376" align="aligncenter" width="580"]Full Collection Evaluation Graph Example 2 Figure 5 - Full Collection Evaluation Graph Example 2[/caption] For some more technical information about how collection evaluation works, see the recording of the ConfigMgrDogs Troubleshoot ConfigMgr 2012 session at TechEd Australia. I'd also like to make a shout out to Jason Wallace who originally put some of this information together.]]> BranchCache for BITS on Windows Professional https://docs.microsoft.com/archive/blogs/scott/branchcache-for-bits-on-windows-professional Sun, 14 May 2017 19:58:16 GMT https://blogs.technet.microsoft.com/scott/?p=316
  • Windows 10 Pro
  • Windows 8.1 Pro
  • Windows 8 Pro
  • Windows® 7 Pro
    • It's even documented in Microsoft Docs - BranchCache. Why is this exciting? Because it means that those of you running Professional versions of Windows clients are able to take advantage of Configuration Manager BranchCache functionality for BITS downloads!

    More Information

    ]]>         Upgrade Analytics Error HRESULT: -2147024891 Access Denied When Running RunConfig.bat https://docs.microsoft.com/archive/blogs/scott/upgrade-analytics-error-hresult-2147024891-access-denied-when-running-runconfig-bat Wed, 07 Dec 2016 12:34:54 GMT https://blogs.technet.microsoft.com/scott/?p=295 03/12/2016 12:15:30 : Attempting to run inventory...This may take a few minutes to complete, please do not cancel the script. 03/12/2016 12:15:30 : Inventory scan Failed, Check error events. HRESULT: -2147024891 Upgrade Analystics Error Screenshot RunConfig.bat requires special permissions on Windows and needs to be run as SYSTEM in some cases. The script may work successfully as an Administrator on some systems, but require SYSTEM on others. If you are using Configuration Manager to run the script, you should be right as Configuration Manager runs as SYSTEM. If you are testing then you can use tools such as PSEXEC to start an interactive command line session as system. Links: ]]> Internal Server Error 500 When Downloading Content - Configuration Manager Client https://docs.microsoft.com/archive/blogs/scott/internal-server-error-500-when-downloading-content-configuration-manager-client Tue, 06 Sep 2016 22:10:48 GMT https://blogs.technet.microsoft.com/scott/?p=66
  • Symptoms
  • Solution
  • What does success look like?

    • Symptoms

    Below are some of the symptoms you might notice if this issue is occurring.

    Software Center

    In Software Center, the application installation state is stuck at Downloading (0% complete). Software Center - Downloading

    ContentTransferManager.log

    ContentTransferManager.log just seems to be stuck attempting to download the manifest.
    Persisted locations for CTM job {E5D716EA-7216-4E4A-A2D9-B25EF52BB692}: (LOCAL) https://BLCM02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1 ContentTransferManager 6/09/2016 2:58:11 PM 2264 (0x08D8) CTM job {E5D716EA-7216-4E4A-A2D9-B25EF52BB692} (corresponding DTS job {8785F7F7-4545-4546-9143-7A796B9C4B4F}) started download from 'https://BLCM02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1' for full content download. ContentTransferManager 6/09/2016 2:58:11 PM 2264 (0x08D8) CTM job {E5D716EA-7216-4E4A-A2D9-B25EF52BB692} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_MANIFEST ContentTransferManager 6/09/2016 2:58:11 PM 2932 (0x0B74) CTM job {E5D716EA-7216-4E4A-A2D9-B25EF52BB692} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_MANIFEST ContentTransferManager 6/09/2016 2:58:44 PM 3032 (0x0BD8)

    DataTransferService.log

    DataTransferService.log is where you will notice Internal Server Error with a HTTP code of 500.
    [CCMHTTP] ERROR: URL=https://BLCM02.breenlab.scottbreen.tech:80/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1, Port=80, Options=224, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODE DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) [CCMHTTP] ERROR INFO: StatusCode=500 StatusText=Internal Server Error DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Raising event: instance of CCM_CcmHttp_Status { ClientID = "GUID:ba70a6eb-cbad-4d5c-a827-322c53dca678"; DateTime = "20160906050836.637000+000"; HostName = "BLCM02.breenlab.scottbreen.tech"; HRESULT = "0x87d0027e"; ProcessID = 1664; StatusCode = 500; ThreadID = 4708; }; DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Successfully submitted event to the Status Agent. DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Successfully queued event on HTTP/HTTPS failure for server 'BLCM02.breenlab.scottbreen.tech'. DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Error sending DAV request. HTTP code 500, status 'Internal Server Error' DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) GetDirectoryList_HTTP('https://BLCM02.breenlab.scottbreen.tech:80/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1') failed with code 0x87d0027e. DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Job {8785F7F7-4545-4546-9143-7A796B9C4B4F} reverted impersonation. DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264) Non-recoverable error retrieving manifest (0x87d0027e). DataTransferService 6/09/2016 3:08:36 PM 4708 (0x1264)

    Internet Explorer Test

    Whenever I have a problem with content, I like to try and access the URL directly from a browser to see if it's a problem with the client, access in general or the server. If you are using HTTPS this may not be as easy as you would need to provide a certificate to authenticate. But if you are using HTTP, you can copy the content path from DataTransferService.log (highlighted in purple above) and paste it into Internet Explorer to see the results. In this case, I also received Internal Server Error. Internal Server Error

    Solution

    The fix.... "ISAPI Extensions" component was missing. ISAPI Extensions is listed as a required by the Distribution Point role according to TechNet. For a full list of requirements, see https://technet.microsoft.com/en-us/library/mt752493.aspx. To check if the component is missing from your server you can use Server Manager or PowerShell.

    Check with PowerShell

    To check with PowerShell, run this command: Get-WindowsFeature Web-ISAPI-Ext If ISAPI Extensions is installed: PowerShell ISAPI not installed If ISAPI Extensions is not installed:PowerShell - ISAPI Extensions Installed

    Check with Server Manager

    To check with Server Manager:
    • Open Server Manager
    • Select Local Server
    • Scroll down to Roles and Features
    • Look for ISAPI Extensions in the list (or search for it)
    If ISAPI Extensions is missing, it's not installed. If ISAPI Extensions is installed, you will see it listed. Server Manager - ISAPI Extensions Installed

    Install with PowerShell

    To install with PowerShell, run this command: Install-WindowsFeature Web-ISAPI-Ext PowerShell - Install ISAPI Extensions

    Install with Server Manager

    To install with Server Manager:
    • Open Server Manager, select Manage > Add Roles and Features.
    • Click Next until you get to the Server Roles screen.
    • Expand Web Server > Web Server > Application Development.
    • Tick ISAPI Extensions
    Tick IASPI Extensions

    What does success look like?

    After the ISAPI Extensions role service is installed, you can test the client is resolved by restarting the SMS Agent Host and checking that the content is now downloaded. Otherwise, clients will eventually retry the installation if they haven't already "failed".

    Software Center

    The application is now installed! Software Center - Installed

    ContentTransferManager.log

    Attempting to send Location Request for PackageID='Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd' ContentTransferManager 6/09/2016 3:23:09 PM 4040 (0x0FC8) Created and Sent Location Request '{77FFB2DB-3F27-4788-9762-471FD512EE4F}' for package Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd ContentTransferManager 6/09/2016 3:23:09 PM 4040 (0x0FC8) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} entered phase CCM_DOWNLOADSTATUS_WAITING_CONTENTLOCATIONS ContentTransferManager 6/09/2016 3:23:09 PM 4040 (0x0FC8) Queued location request '{77FFB2DB-3F27-4788-9762-471FD512EE4F}' for CTM job '{2B609C31-EE94-4FC6-BBE2-9D450E78A155}'. ContentTransferManager 6/09/2016 3:23:09 PM 4040 (0x0FC8) Persisted locations for CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155}: (LOCAL) https://BLCM02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1 ContentTransferManager 6/09/2016 3:23:09 PM 5416 (0x1528) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} (corresponding DTS job {3A9324A4-74F8-4063-B2D7-74EFE9FA2510}) started download from 'https://BLCM02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1' for full content download. ContentTransferManager 6/09/2016 3:23:09 PM 5416 (0x1528) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_MANIFEST ContentTransferManager 6/09/2016 3:23:09 PM 6004 (0x1774) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} entered phase CCM_DOWNLOADSTATUS_PROCESSING_MANIFEST ContentTransferManager 6/09/2016 3:23:10 PM 5920 (0x1720) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD ContentTransferManager 6/09/2016 3:23:10 PM 5916 (0x171C) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA ContentTransferManager 6/09/2016 3:23:10 PM 4844 (0x12EC) CTM job {2B609C31-EE94-4FC6-BBE2-9D450E78A155} successfully processed download completion. ContentTransferManager 6/09/2016 3:23:10 PM 5924 (0x1724)

    DataTransferManager.log

    Restarted DTS job '{8785F7F7-4545-4546-9143-7A796B9C4B4F}' in state DownloadingManifest. DataTransferService 6/09/2016 3:22:30 PM 4908 (0x132C) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'DownloadingManifest'. DataTransferService 6/09/2016 3:22:30 PM 4908 (0x132C) Job {8785F7F7-4545-4546-9143-7A796B9C4B4F} impersonating logged on user. DataTransferService 6/09/2016 3:22:30 PM 4844 (0x12EC) Detecting if client is on the internet. DataTransferService 6/09/2016 3:22:30 PM 4844 (0x12EC) Client is not set to use any webproxy. DataTransferService 6/09/2016 3:22:30 PM 4844 (0x12EC) GET: Host=BLCM02.breenlab.scottbreen.tech, Path=/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1, Port=80, Protocol=http, Flags=645, Options=224 DataTransferService 6/09/2016 3:22:30 PM 4844 (0x12EC) Resending the request by setting the credentials on getting an unauthorized response. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Setting autologon policy for integrated auth request. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Raising event: instance of CCM_CcmHttp_Status { ClientID = "GUID:ba70a6eb-cbad-4d5c-a827-322c53dca678"; DateTime = "20160906052231.543000+000"; HostName = "BLCM02.breenlab.scottbreen.tech"; HRESULT = "0x00000000"; ProcessID = 5880; StatusCode = 0; ThreadID = 4844; }; DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Status Agent hasn't been initialized yet. Attempting to create pending event. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Raising pending event: instance of CCM_CcmHttp_Status { ClientID = "GUID:ba70a6eb-cbad-4d5c-a827-322c53dca678"; DateTime = "20160906052231.543000+000"; HostName = "BLCM02.breenlab.scottbreen.tech"; HRESULT = "0x00000000"; ProcessID = 5880; StatusCode = 0; ThreadID = 4844; }; DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Successfully submitted pending event to WMI. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) UpdateURLWithTransportSettings(): OLD URL - https://blcm02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/sccm?/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1/ DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) UpdateURLWithTransportSettings(): NEW URL - https://blcm02.breenlab.scottbreen.tech:80/SMS_DP_SMSPKG$/sccm?/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1/ DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) UpdateURLWithTransportSettings(): OLD URL - https://blcm02.breenlab.scottbreen.tech/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1/sccm?/NM34_x64.exe DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) UpdateURLWithTransportSettings(): NEW URL - https://blcm02.breenlab.scottbreen.tech:80/SMS_DP_SMSPKG$/Content_fe46ebd4-7c29-4f8c-b8b6-c166e0e84ebd.1/sccm?/NM34_x64.exe DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Job {8785F7F7-4545-4546-9143-7A796B9C4B4F} reverted impersonation. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'RetrievedManifest'. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'PendingDownload'. DataTransferService 6/09/2016 3:22:31 PM 5916 (0x171C) DTSFlag is 0x0040050e DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Exclude file list: DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) Using branch cache option DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'DownloadingData'. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'RetrievedData'. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} successfully completed download. DataTransferService 6/09/2016 3:22:31 PM 4844 (0x12EC) DTSJob {8785F7F7-4545-4546-9143-7A796B9C4B4F} in state 'NotifiedComplete'. DataTransferService 6/09/2016 3:22:31 PM 5916 (0x171C)
    ]]>         Scheduling Software Updates to Run on Patch Tuesday https://docs.microsoft.com/archive/blogs/scott/scheduling-software-updates-to-run-on-patch-tuesday Wed, 10 Aug 2016 22:00:30 GMT https://blogs.technet.microsoft.com/scott/?p=35 Figure 1: Automated Deployment Rule

    ADR Configuration

    Automated deployment rules can be configured to:
    • Not execute automatically;
    • Execute after Software Update Point synchronisation, or;
    • Execute on a schedule.
    If configured to run on a schedule, the recurrence options are:
    • None;
    • Every 1 or more months on a specific day;
    • Every 1 or more months on the last day of the month
    • Every 1 or more months on the first, second, third or fourth or last specific day of a month;

    The Problem

    A number of organisations like to schedule their patching cycle to align with Microsoft Patch Tuesday so that updates are deployed as quickly as possible after release and on a predictable cycle. In addition, some organisations like to schedule updates in advance to provide the business with predictable maintenance windows and schedules. “Patch Tuesday” is a well-known term in the industry that refers to the second Tuesday of every month (USA time) when Microsoft releases patches. Patches are usually released at 10am Los Angeles time. (PDT). For organisations with a time zone that has week days that closely align with USA time, this is as simple as setting the recurrence pattern of the ADR to the second Tuesday of each month and creating deployments with deadlines based on the number of days since the rule was executed. However, for organisations in time zones with a week day ahead of the USA, this presents a challenge. On the face of it, it would seem that setting the recurrence pattern to the second Wednesday of each month would solve the problem, but the second Wednesday of each month does not always follow the second Tuesday of a month. Given the release time, time zones with a time zone offset of +7 will find it impossible to use the recurrence pattern to schedule based on patch Tuesday and other time zones will struggle to find the most appropriate time in the day to schedule the update. Based on daylight savings times in 2016, Table 1 demonstrates the variation in time across the year between time in Los Angeles, USA and Brisbane or Sydney in Australia.
    Month Los Angeles Time Zone Brisbane Time AEST Sydney Time AEST/ADEST
    Jan PST 4am 3am
    Feb PST 4am 3am
    Mar PST/PDT 3am/4am 2am/3am
    Apr PDT 3am 3am
    May PDT 3am 3am
    Jun PDT 3am 3am
    Jul PDT 3am 3am
    Aug PDT 3am 3am
    Sep PDT 3am 3am
    Oct PDT 3am 2am
    Nov PST 4am 3am
    Dec PST 4am 3am
    Table 1: Patch Tuesday Release Time by Time Zone in 2016

    The Solution

    The potential solutions for this are:
    • Manually execute the ADR each month on the appropriate day;
    • Run the ADR on an arbitrary date that is always after the second Tuesday of each month based on USA time and use manually updated maintenance windows to control update installation over the year;
    • Schedule a script to detect patch Tuesday and execute the ADR.
    Using a script is the only method that allows for complete automation and consistent deployment based on the patch cycle and patching based on particular days. The added benefit of using a script is the ability to add extra automation such as sending a summary email. I've written a sample script that provides this functionality. The script is designed to run daily and checks the local time on the server against PDT and if the day is Patch Tuesday PDT time it will execute the following steps:
    • Check if WSUS sync has completed since patch Tuesday;
      • If not, execute and monitor a WSUS sync;
    • Execute the defined Automated Deployment Rule and monitor its execution;
    • Modify the name of the ADR;
    • Modify and generate new deployments for each deployment group (based off the CSV);
    • Sends an email with the schedule and update details.
    An example of the generated email message is displayed in Figure 2. The schedule section links to the “Software Updates Deployment – Deployment States” report for the collection listed and the relevant software update deployment. Software Updates Email Figure 2: Software Updates Email

    Download

    For more information about the script and how to set it up, head over to TechNet Gallery.]]>         Hello! https://docs.microsoft.com/archive/blogs/scott/hello Wed, 27 Jul 2016 06:24:37 GMT https://blogs.technet.microsoft.com/scott/?p=1
  • About me: https://about.me/scottbreen
  • Previous Blog: https://blog.scottbreen.tech
    • ]]>