1. Technical Case Study: How Microsoft IT Deployed System Center 2012 Configuration Manager
• https://technet.microsoft.com/en-us/library/hh913620.aspx
2. Technical Case Study: User-Centric Client Management with System Center 2012 Configuration Manager in Microsoft IT
• https://technet.microsoft.com/en-us/library/hh925141.aspx
3.  System Center 2012 Configuration Manager Hardware used for site roles in Microsoft IT
• https://blogs.msdn.com/b/shitanshu/archive/2012/04/10/configuration-manager-2012-hardware-configuration-used-in-microsoft-it.aspx
4.  System Center 2012 Configuration Manager Exchange Connector Implementation in Microsoft IT
• http://blogs.technet.com/b/system_center_in_action/archive/2011/09/02/configuration-manager-2012-exchange-connector-implementation-in-microsoft-it.aspx 
5.  Client Migration from Configuration Manager 2007 to System Center 2012 Configuration Manager
• https://blogs.technet.com/b/system_center_in_action/archive/2012/01/14/client-migration-blog.aspx
6.  Distribution Point migration from Configuration Manager 2007 using the migration feature of System Center 2012 Configuration Manager
• https://blogs.technet.com/b/system_center_in_action/archive/2012/04/26/distribution-point-migration-from-configuration-manager-2007-using-the-migration-feature-of-system-center-2012-configuration-manager.aspx
7.  Implementing Packaging and Testing work flows in System Center 2012 Configuration Manager using Role Based Access
• http://blogs.technet.com/b/system_center_in_action/archive/2011/12/01/implementing-packaging-and-testing-work-flows-in-configmgr-2012-using-role-based-access.aspx
8. Custom SQL Replication reports for System Center 2012 Configuration Manager
• https://blogs.technet.com/b/system_center_in_action/archive/2012/05/02/custom-sql-replication-reports-for-system-center-2012-configuration-manager.aspx

I will continue to update this list as we publish more blogs and case studies. Please share your comments such as what other topics you would like to hear from us related to Configuration Manager deployment at Microsoft IT.

For more details on supported configurations and recommended hardware please refer product documentation -

Planning for Hardware Configurations for Configuration Manager: https://technet.microsoft.com/en-us/library/hh846235.aspx

Supported Configurations for Configuration Manager: https://technet.microsoft.com/en-us/library/gg682077.aspx

The table below shares our hardware configuration for our Configuration Manager environment.

Central Administration Site (CAS)

Our Central Administration Site (CAS) is managing ~280,000 clients at Microsoft IT and has following site roles globally

• 5 Primary sites
• Each Primary Site has Application Catalog and Fallback Status Point role
• 13 Secondary sites which has proxy Management Points and Distribution Point role.
• 11 Software Update Point
• 220+ Distribution Points

* Microsoft IT data center standard versions

CAS – Hard Disk and Array Configuration

Primary Site with Fallback Status Point and Application Catalog

 At Microsoft, we have all Primary site servers with SQL Server on remote site server computer. The reason we chose to have remote SQL server for all primary sites is because all sites have between 40,000 and 75,000 clients managed so we are looking to have better performance with future client growth. We virtualized all Primary site roles with configurations shown below:

* Microsoft IT data center standard versions

Primary Site – Hard Disk Configuration

Remote SQL Server

We have 2 configurations for remote SQL server at Microsoft.

1. Remote SQL Server for more than 50,000 clients

2. Remote SQL Server for less than 50,000 clients

Currently for remote SQL server more than 50,000 clients we have ~75,000 clients managed and for remote SQL server less than 50,000 clients we have ~40,000 clients managed. Here are server specifications details for both remote SQL servers. Also these SQL servers are also hosting WSUS database along with Configuration Manager Database.

* Microsoft IT data center standard versions

Remote SQL Server for more than 50,000 Clients – Hard Disk Configuration

Remote SQL Server for less than 50,000 Clients – Hard Disk Configuration

Management Points

We have all multiple management points are each primary site for service continuity.

* Microsoft IT data center standard versions

Management Point – Hard Disk Configuration

Software Update Points

 We have all software update points (SUP) configured in Network Load Balance (NLB) in each primary site for service continuity. These SUP roles are having dedicated server role as we use WSUS for driver management as well.

* Microsoft IT data center standard versions

Software Update Point – Hard Disk Configuration

Secondary Site + Distribution Points

We have 13 Secondary Site which has Proxy Management Point and Distribution point role assigned our out of 225 Distribution point worldwide. The hardware configuration for these distribution point + secondary site + proxy management point is same worldwide

* Microsoft IT data center standard versions

Secondary Site / Distribution Point – Hard Disk Configuration

Please share your comments for these platform standards and I would be glad to answer any queries. I want to acknowledge my team – Arun Ramakrishnan, Blair Wright, Partha Chandran, Benjamin Reynolds and Naveen Kumar who contributed for these platform standards.

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of any included script samples are subject to the terms specified in the Terms of Use

Session Details: CD-B320: How Microsoft Deployed Configuration Manager 2012 to 280,000 Desktops

Date & Time: 19th April, Thursday 4:00 PM - 5:15 PM Venetian Ballroom I

Speaker(s): Karthik Jayavel, Shitanshu Verma, Dharmendra Thotakura;

Session Abstract: Bring your deployment questions and join this session to hear from the team that's done the largest deployment to date of Microsoft System Center 2012 Configuration Manager. Hear about the overall project schedule, migration, hardware specification, client deployment, software center, settings management, the new app model, integrated management and security, and more. You can take this deployment as a blueprint for your own Configuration Manager deployment—in what to do or what not to do.

In addition to above our group is also presenting below sessions:

As every year, I am also very interested to exchange thoughts and best practices along with my group for overall managing Configuration Manager, Operations Manager, Service Manager at Microsoft. So if you are interested for having chat / discussion around below proposed topics or any other areas please feel free to send a mail to me or Catherine at shverma@microsoft.com or MPSDshow@microsoft.com . In case we are not expert for the area you are looking for chat/discussion, we will get you connected with right folks to provide you the answers during the conference.

1. How Microsoft IT manages Configuration Manager 2012 hierarchy?
2. What’s our service operations and engineering team structure look like? 
3. How we measure Configuration Manager Health and Availability?
4. Ask how we manage Patch deployment on desktops and servers?
5. What’s our SLA for different services related to Configuration Manager?

Looking forward to meet the System Center community in MMS 2012

In this blog, I am going to share how we designed our Configuration Manager 2012 hierarchy.

Let’s first go through key facts for our hierarchy design at Microsoft.

The key desktop management services where we use Configuration Manager are listed below:

· Hardware and Software Asset Reporting

· Software Metering

· Software Deployment

· Software Update Management aka Patch Management

· Operating System Deployment

· Application Virtualization Deployment (App-V)

· Malware Protection (Forefront)

· Power Management

· Mobile Device Management

At Microsoft, our administration model for all systems is centralized administration, so all deployment and reporting is done from a central site. Before I share with you our new hierarchy design for Configuration Manager 2012, it is important for us to review our Configuration Manager 2007 hierarchy, as it will help in understanding some of key benefits you will able to achieve through new features of Configuration Manager 2012.

Figure 2: Configuration Manager 2007 hierarchy at Microsoft (Before state)

As you see in figure 2, we had 5 Configuration Manager 2007 primary sites aligned with regional locations. The first thing we decided was to deploy new Configuration Manager 2012 hierarchy in parallel to the above hierarchy because, as most of you might be already aware, Configuration Manager 2012 is not supported for in-place upgrade from Configuration Manager 2007. To start, we deployed Central Administration Site (CAS) and 3 child primary sites in phase 1. We decided to move all our machines reporting to Corporate headquarters (Redmond) and North and South America to Configuration Manager 2012 in a phase 1, which accounts for almost 50% of total machines managed in Configuration Manager 2007. During all client moves, we always ensured minimum service interruptions to end users along with meeting our standard service level agreements (SLA) for our services such as monthly patching SLA, and client health SLA.

Below is our Configuration Manager 2012 hierarchy as of today. We are making progress to add 2 more child primary site and moving clients from others regions such as Asia and Europe.

Figure 3: Configuration Manager 2012 hierarchy at Microsoft (Current state)

In figure 3, you will notice we have a total of 4 site systems hosted on physical servers, which include the CAS and all primary SQL servers, whereas the rest of the site systems are hosted on virtual servers.

The second thing you will notice is that we don’t have remote SQL server for CAS site, which differs from our use of remote SQL server for central site in Configuration Manager 2007. In Configuration Manager 2012, all client data is processed at the primary site level and is replicated to the CAS site through global and site data replication. The central administration site is only used for administration and reporting purposes. We did a comparison of the average processor utilization between Configuration Manager 2007 central site and Configuration Manager 2012 central administration site and found that CAS is ~20-30% less utilized than Configuration Manager 2007 SQL server.

The third major change you will see in figure 3 is that for the North and South America primary site, we had only 3 secondary sites. Compare this to the 35 secondary sites we used in Configuration Manager 2007 (refer figure 2). This is only possible because the distribution point sites system role in Configuration Manage 2012 can have scheduling and throttling settings for content distribution, which was only available for secondary site roles in Configuration Manager 2007.

The fourth benefit we had was for management point roles, as we used a new feature MPlist to allow us to have multiple management points without need of Network Load Balancing (NLB).

The fifth benefit we’re seeing from an infrastructure perspective is that we don’t need a dedicated primary site for site-level client settings.  By this, I mean in Configuration Manager 2007, we had a limited service site to offer only patching services to one of our internal customers – labs. It was business critical requirement that there be no Configuration Manager admin accidentally deploys software to that group. To meet this requirement in Configuration Manager 2007, we used a have a separate primary with the setting software distribution to client disabled.  In Configuration Manager 2012, we can combine the right Role Based Administration and Client Agent Settings to be confident we can meet this business requirement. As a result, we will be able to collapse the limited service primary site.  We will write more about RBA later on.

There are so many things to share about Configuration Manager 2012. One of my colleagues blogged already on mobile device management in MSIT here: https://blogs.technet.com/b/system_center_in_action/archive/2011/09/02/configuration-manager-2012-exchange-connector-implementation-in-microsoft-it.aspx. We will continue to share our story, and the next blog post will focus on our experience migrating clients from Configuration Manager 2007. Please share your comments and questions! .

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included samples is subject to the terms specified in the Terms of Use

Here are our session details:

SIM330 Client Management and Protection at Microsoft: Real-World Deployment Case Study of Microsoft Forefront Endpoint Protection

Date, Time & Room: Thursday, May 19 | 1:00 PM - 2:15 PM | Room: C208

Level: 300 - Advanced

Abstract: Join this session to learn how Microsoft IT converged security management and desktop management using single infrastructure on 280,000 desktops. With just a single server purchase, see how Microsoft was able to integrate the existing System Center Configuration Manager 2007 environment with Forefront Endpoint Protection (FEP) 2010. You will walk away with the knowledge of Microsoft IT’s FEP deployment architecture, client roll out strategy and best practices in integration. See just how easy it is to deploy FEP in your own organization.

SIM337 Integrating the Microsoft System Center Stack for Process Compliance and Automation

Date, Time & Room: Thursday, May 19 | 10:15 AM - 11:30 AM | Room: C302

Level: 300 - Advanced

Abstract: In this session, see how Microsoft has integrated System Center Configuration Manager Desired Configuration Manager (DCM), System Center Operations Manager, and System Center Service Manager to standardize the global Configuration Manager environment. The presentation shares using compliance/non-compliance information from DCM on security, IIS, and other standard settings, alerting through System Center Operations Manager, and managing tickets in System Center Service Manager. This integration is allowing for tighter security compliance and more actionable reporting so that the datacenter environment is secure and compliant for audits. In addition, this session shares dashboarding of the data including developing custom reports using Microsoft SQL Server Reporting Services.

Looking forward to meet you folks next week in Atlanta and exchange real world IT operations best practices.

Session Details: BI04 Integrating Management & Security at Microsoft: Forefront Endpoint Protection 2010 deployment case study at Microsoft

Date & Time: 24^th March, Thursday 4:00 PM - 5:15 PM, South Seas C

Speaker(s): Shitanshu Verma & Partha Chandran

Session Abstract: Join this session to learn how Microsoft IT converged security management & desktop management using single infrastructure on 280,000 desktops. With just a single server purchase, see how Microsoft was able to integrate the existing System Center Configuration Manager 2007 environment with Forefront Endpoint Protection (FEP) 2010. You will walk away with the knowledge of Microsoft IT’s FEP deployment architecture, client roll out strategy and best practices in integration. See just how easy it is to deploy FEP in your own organization.

In addition to above our team is also presenting or co-presenting below sessions:

Session	Title	Speakers	Time Slot
BG01	Using System Center Service Manager for Incident Change, and Problem Management	Travis Wright & Brian Copps	Tuesday, March 22nd : 10:15AM - 11:30AM
BG03	Converting Your Existing Software Packages into the Configuration Manager 2012 Application Model	Chris Adams & Cameron King	Thursday, March 24th 8:30AM - 9:45AM
BG02	Client Health in Configuration Manager 2012 – How Microsoft IT is Using It	Kristina Ashment & Paul Thomsen	Thursday, March 24th, 10:15AM - 11:30AM
BB54	Opalis Client Real World Scenarios (title still being updated)	Eamon O'Reilly, Charlie Satterfield, Rehan Jaddi	Thursday, March 24th, 4:00PM - 5:15PM
BA17	Virtualizing Configuration Manager – What you need to know and how to get there	Chris Adams & Ben Shy	Monday, March 21st: 1:30PM - 2:45PM
	Client Health Birds of a Feather	Paul Thomsen; Kristina Ashment	Wednesday, March 23th, 6:45 PM

Also I am very interested to exchange thoughts and best practices from my team for overall managing Configuration Manager, Operations Manager, Service Manager at Microsoft. So if you are interested for having chat / discussion around below proposed topics or any other areas please feel free to send a mail to me or Catherine at shverma@microsoft.com or MPSDshow@microsoft.com . In case we are not expert for the area you are looking for chat/discussion, we will get you connected with right folks to provide you the answers during the conference.

1. What is Microsoft IT Configuration Manager 2012 deployment strategy?
2. How Microsoft IT manages Configuration Manager hierarchy?
3. What is our Configuration Manager virtualization story and how much we saved?
4. How we measure Configuration Manager Health and Availability?

Looking forward to meet the experts & leaders in MMS 2011.

Service Engineer, Senior, United States, WA, Redmond (https://careers.microsoft.com/JobDetails.aspx?jid=32308&lang=en)

About our Group: The Management Platforms and Service Delivery (MPSD) team is responsible for driving pre-release deployments of MSD software into production environments in order to provide critical product feedback on the System Center family of products.  We do this so that when our products go to market they have already passed a high quality bar across several enterprise deployments. We engineer and operate System Center Configuration Manager (ConfigMgr), Forefront, Opalis and other complimentary software across deployments at Microsoft, Microsoft’s retail stores and few external customers.

Our role is to drive improvements into our products and services by dogfooding, operating, and extending these management and security solutions. We drive innovation, ensure quality and reliability, and manage down costs to provide value to our development, test and program management partners. MPSD then shares our best practices, accomplishments, lessons learned and tools with Microsoft’s customers through whitepapers, blogs, presentations and solution accelerators. The addition of MPSD has taken the traditional product development cycle and turned it into a quad – Dev, Test, PM, and Ops, all working closely together to deliver great products and online services.

If you are looking for a fast paced environment where you can make substantial impact, we encourage you to apply.

Solution: We have created a SQL job which runs a query at each Primary Site once per day (could be scheduled more frequently if needed). The query is designed to look at SUP scan state data in the v_updateScanStatus view and determine if SUP scan compliance is above 95% for the Primary Site. If any site is showing less than 95% scan success, a Windows Application Event will be generated that can be consumed by OpsMgr monitoring. 

Steps to create the SQL job for monitoring Client Scan failures

The SQL job will run on the Central Site database server and the following steps assume you have logged onto the Central Site database server and have opened SQL Server Management Studio.

1. In Object Explorer, connect to an instance of the SQL Server Database Engine, and then expand that instance.

2. Expand SQL Server Agent, right click JOBS and select ‘New Job’

3. In the New Job Properties dialog,box type SUPScanSuccess in the Name field

4. Under ‘Select a Page’ Click the Steps page, and then click New.

5. In the New Job Step dialog, Click the NEW button

a. Type this job step name: SUPScanSuccess.

b. In the Type list, click Transact-SQL Script (TSQL).

c. In the Database dropdown list, select the SMS_xxx database

d. In the Command box, paste the Transact-SQL command below. (see below in document)

e. Click Parse to check your syntax.

f. The message "The command was successfully parsed" is displayed when your syntax is correct; if you see this message click OK to clear the message box. . If an error is found, correct the syntax before continuing by retrying the copy/paste procedure and overwriting the previous paste job. (the screenshot below is a generic example)

Transact SQL Script:

DECLARE @@MESSAGE varchar(200)
Set @@MESSAGE = 'SUP Client Scan success rate was less than a 95% success rate in the last 24 hours'
Declare @percent decimal(18,5)
declare @olddate datetime
set @olddate=DATEADD(HOUR,-24, getutcdate())
set @noCom = (select count(*) as clients
                from v_updateScanStatus upp
                join v_statenames stat on stat.stateid = upp.lastscanstate
                join v_RA_System_SMSAssignedSites site on site.resourceid = upp.resourceid
                and stat.topictype ='501'
                and upp.lastscanpackagelocation like'http%'
                where stat.StateName in ('Scan Failed ')
                and upp.ScanTime > @olddate
                group by upp.lastscanstate,stat.statename,site.sms_assigned_sites0)
set @yesCom = (select count(*)as clients
                from v_updateScanStatus upp
                join v_statenames stat on stat.stateid = upp.lastscanstate
                join v_RA_System_SMSAssignedSites site on site.resourceid = upp.resourceid
                and stat.topictype ='501' and upp.lastscanpackagelocation like'http%' where stat.StateName in ('Scan Completed ') and upp.ScanTime > @olddate
                group by upp.lastscanstate,stat.statename,site.sms_assigned_sites0)
set @percent = ((@noCom/@yesCom)*100)
If @percent > 5
Begin
EXEC xp_logevent 60020, @@MESSAGE, Warning
END

6. Click OK to the New Job Step dialog box to return to the New Job pane.

7. Under “Select a Page” choose Schedules and click New to open the New Job Schedule pane

a. In the name field type SUPScanSuccess

b. Under Frequency change the value to Daily

c. Under Daily Frequency choose the “Occurs once at” radio button

               Change the setting to occur at 2:30 a.m.

d Verify the Description states the job will run every day at 2:30 A.M.

8. Click OK to close the New Job box.

Validation Steps: Verify the new job exists in SQL Management Studio>SQL Server Agent>JOBS, you can verify settings of the job by right clicking the job and choosing Properties.

Last but not the least I want to acknowledge one of team member – Scott Elieff who helped us in writing this custom monitoring SQL job. Special THANKS to him.

Please share your comments for these custom monitoring task and I would be glad to answer any queries.

What’s next for this custom monitoring series?

Custom monitoring for SUP Client Installation

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of any included script samples are subject to the terms specified in the Terms of Use

Situation: Microsoft is committed to an ambitious goal of cutting its enterprise carbon emissions by 30% over a five-year period. To help contribute to this goal, Microsoft IT wanted to build on its System Center Configuration Manager 2007 desktop management infrastructure to implement a flexible and centralized power management solution. MSIT also wanted to fully leverage power management capabilities in products such as Windows 7. The solution needed to effectively manage, monitor, and report client power utilization across the enterprise.

Solution: Using System Center Configuration Manager 2007 R3, Microsoft IT deployed a power management solution to 165,000 desktop and laptop computers. Through new tools that enable centralized management, powerful reporting, and a deep understanding of current power settings, MSIT realized significant energy and cost savings. The solution provides a high degree of flexibility, and different levels of enforcement. In addition to delivering on power usage and carbon reduction goals, the solution also delivers on the Microsoft IT-specific goal of driving product feedback to deliver a successful power management product.

Benefits:

• 27 percent drop in the amount of power used by the managed desktop computers
• A projected savings of $12 - $14 USD per desktop computer per year, based on currently reported data
• Centralized power management and enhanced reporting capabilities
• Leveraging existing client management infrastructure minimizes cost and expense

Detailed Technical Case Study is available here  https://technet.microsoft.com/en-us/library/gg398008.aspx

Note: The above link was changed so if you downloaded this case study prior to 4th Nov. 2010, please download this case study again for latest and updated version.

Special THANKS to our operations team members for their contribution to this technical case study release and to name to few of them are Chandramouli Kothandaraman, Partha Chandran and Jitendra Ramesh Kalyankar.

Please share your comments for this technical case study and I would be glad to answer your queries.

In this post I am covering monitoring scenarios to alert for missing AD site which are not configured as ConfigMgr boundaries and creating event for OpsMgr. In Microsoft IT, we have large environment which makes challenging to keep track of all changes in AD and keeping align ConfigMgr site boundaries with AD site which impact our reach and compliance SLA. This AD site boundary script proactively checks AD site against site boundaries configured in ConfigMgr database and reports any AD site which are not configured as site boundary through OpsMgr alert.

The AD Site Script is designed to be ‘automated’ from a scheduled task. Once invoked, the script will connect to the root of the data directory tree in the AD forest and iterate through all listed AD Sites. For each AD site found, it will then connect to the ConfigMgr central site server’s SQL database (specified within the script as highlighted in yellow) to validate that a matching site is found within the database.

If a match is found in the ConfigMgr SQL DB, then the AD Site Script will log an Information event to the local server’s Application Log. This event is purely for additional information and can be ignored from a SCOM perspective. (An informational event will only be logged if bVerbose is set to true, the default value is false).

If no matching AD site entry is found in the central site’s database, the AD Site Script will log a Warning event to the local machine’s Application Log. This event can be tracked\monitored by SCOM.

Note: The script will need elevated permissions as it will write log entries to the local server’s Application Log in the Event viewer and is configured as scheduled task on our ConfigMgr Central site.

Before we talk about the script I want to mention the original author of this script - Ben Shy who helped us writing this custom monitoring script for fixing gaps in ConfigMgr Boundaries for sites. Special Thanks to him.

The following denotes specific events that the script can generate locally in the server that it is executed from Event Viewer through scheduled task which can be monitored and alerted by OpsMgr.

Event when found an AD Site that is in ConfigMgr database (not enabled by default)

If the script finds an AD site that is also in ConfigMgr database, it’ll log the following informational event (only if bVerbose = True)

Event ID = 880

Level = Information

Example:

Event when found an AD site that is not in ConfigMgr database

If an AD site is found  (which isn’t in the exclusion list) that is *not* in ConfigMgr database, the following will be logged to the event viewer.

Event ID = 887

Level = Warning

Example:

Please share your comments for these custom monitoring task and I would be glad to answer any queries.

What’s next for this custom monitoring series?

Custom monitoring for SUP/WSUS Scan failures

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of any included script samples are subject to the terms specified in the Terms of Use