System Center Essentials Team Blog

Deploying KB2607070 on Win7 SP1 SCE managed clients

Mangesh Sonar [MSFT] — Mon, 12 Sep 2011 07:04:00 GMT

An update has been released to resolve issues where System Center Essentials updating Windows 7 SP1- based computers with locally published content may fail with error 0x80070570. Please refer to http://support.microsoft.com/kb/2607070 for more details and download.

This hotfix is expected to be installed individually on all Win7 SP1 machines which are managed by SCE server. However, you can use Software Deployment’ feature in SCE Server to deploy these packages on all Win7 SP1 machines in a single go. Please see "How to Deploy" section below.

Command line parameters for the Package -

These are the command line parameters available for WindowsUpdateAgent30-x86 (KB2607070).

This option helps you to deploy the hotfix on Win7 SP1 machines from SCE server itself in an unattended way.

Notes –

I recommend restarting the system after installing this hotfix. If you use /norestart option, system won’t reboot; however patch will not be functional and you might still encounter 0x80070570.
How to verify whether package is installed successfully?

Extract the package WindowsUpdateAgent30- /x: C:\temp
Check the binary versions of windows update binaries in the extracted folder C:\temp. For example - wuaueng.dll, wuapi.dll, wups.dll etc. will be at version 7.6.7600.243.
When you install the KB2607070, these binaries would be updated in the system folder (say for example %windir%\system32) after reboot.

How to Deploy

Install directly on all Win7 SP1 machines which are managed by SCE server

This is a straight forward install of any typical Microsoft hotfix. You can download the package and launch WindowsUpdateAgent30-x86 (KB2607070) on Win7 SP1 client systems in your SCE environment. Installer will prompt for a reboot if installed in an attended mode. If you use /quiet, it will not prompt for a reboot but then you would need to reboot the system in order to get the patch applied and functional.

What will happen when you use Default Deployment Procedure in SCE using ‘Software Deployment’ feature?

Kindly refer to this TechNet link for additional details on how to create and deploy software packages.

This update is a windows update agent itself and hence turns off windows update followed by an immediate turn on. As soon as this process ends, package payloads are updated in the system.
Log file shows "user cancelled the installation" because of this, but after restart package would be up and functional.
As windows update is restarting during the update, the state of the previous install is not retained into its database and hence package gets reoffered.

If you install using DISM mechanism as explained below in the blog, you won't encounter these issues and you can overcome them. However, patch gets deployed correctly with an explicit reboot if you follow default flow of local publishing and deploying the package from SCE console. To do that,

In the System Center Essentials console, please click on software.
Click on “New Package” in the “Software Packages” section of “Tasks” pane. (Highlighted)

3. Please download KB2607070 locally onto your machine from download center.

4. In the New Software Package Wizard provide the path to WindowsUpdateAgent30-x86.exe in the textbox under “Deploy a package from stand-alone setup file” option and click “Next”.

5. Provide package name and package description in the next page of the wizard and click Next.

6. Apply necessary settings in the Target System Types page and click next

7. In the “Install/ Uninstall Parameters” page for quiet installation provide “/quiet” switch in the “Installation Parameter(s)” and click next

8. Click Create button in the Summary page, this creates a package.

9. Select appropriate group of computers in Add and Remove Approvals wizard and click ok, by default Win7 SP1 clients will be listed under “All Windows Client” group.

With these steps, you have published the package for managed Win7 SP1 machines. Now these Win7 SP1 machines can have the published WindowsUpdateAgent30-x86.exe (KB2607070) package available in the Windows Update window.

Admins can set a deadline and this hotfix would be pushed on the user systems even if they don’t install it explicitly. (See highlighted below)

Within few minutes of a specified deadline when package offering is complete, please reboot individual Win7 SP1 systems.

Otherwise, users on managed computers can always install the hotfix on the system before the deadline by obeying the below steps-

Open Windows Update on the client machine.
Check for new updates in the Windows Update Window

3. Select the update deployed on the SCE server and click OK.

4. Click Install Updates button.

5. This will install the update on the client machine by closing the Windows Update client window.

6. We need to restart the client machine for this update to get affected.

Installation using DISM (Deployment Image Servicing and Management) -

* This is based on approach proposed by LGS on SCE TechNet Forum*

You can use an open source tool called RunIt.exe where as DISM is available in system32.

Download WindowsUpdateAgent30-x86.exe to your desktop.
Create an empty folder (extracted) on the desktop.
Extract the exe to an empty folder(extracted) on the desktop, using following command “WindowsUpdateAgent30-x86.exe /x”, provide the path click OK on the prompted UI.

4. Click OK when extraction is complete.

5. Create an empty folder (WUA Update) on desktop.

6. Download runit.exe from web and copy it to newly created WUA Update. Move/Copy 'extracted' folder to WUA Update.

7. Open System Center Essentials.

8. Go to "Software" Click on the “New Package” under “Software Packages” section in “Tasks” pane.

9. Select the “Deploy a package from a setup file requiring additional folders” radio button in the New Software Package Wizard.

10. Provide the Folder Location by browsing to the folder WUA update. Click Ok.

11. To provide the Package setup file, click Browse beside package setup file text box.

12. Select RunIt.exe and click Open. Click Next in the wizard

13. Provide Package Name and Package Description and click Next.

14. Select appropriate target system types as mentioned below and click Next.

15. Map 3010 return code with Success With Reboot, by providing details(Code and Value) and clicking on Add.

16. Click Next.

17. Provide the installation parameters as mentioned below and click Next.

Install Parameters are - /L dism /Online /Add-Package /Packagepath:extracted /quiet /norestart.

Internally Windows update triggers following command. RunIt.exe /L dism /Online /Add-Package /Packagepath:extracted /quiet /norestart

RunIt.exe : invokes the exe file specified after parameter “/L” with the remaining parameters(/Online /Add-Package /Packagepath:extracted /quiet /norestart)

Dism: it is an exe file provided by Windows used for Servicing and management of Deployment image.

Online: Specifies that the action is effect on current windows running image Add-Package: adds the packages specified by PackagePath parameter to the Image /quiet and /norestart: these parameters will be used by the package while install happens on next reboot.

18. Click Create on summary page.

19. Package Creation would get progressed and then click Finish.

20. Add and Remove Approvals window appears. Select appropriate options in this window and click Ok.

21. Within few minutes after the deadline exceeds, you would observe a restart prompt on your machine.

NOW LIVE: The Microsoft TechNet Gallery

J.C. Hornbeck — Thu, 18 Aug 2011 07:45:20 GMT

As many of you probably already know, for a long time the Script Repository (a special-purpose gallery) has been an engine of great content and community engagement on TechNet. Well starting last week it was upgraded significantly and launched as the new TechNet Gallery, supporting not only just scripts but many other technical resources for Microsoft products including App-V, Exchange, and System Center.

Also of note is that in addition to English, the new gallery is available in French, German, Spanish, Japanese, Simplified Chinese, Traditional Chinese, Brazilian Portuguese, Russian, Italian, Korean, Czech, Polish, and Turkish. Individuals’ contributions and engagement with the TechNet Gallery are tracked in their TechNet profiles and fully integrated with our reputation system which is also fully localized.

If IT resources like scripts, management packs, utilities, and extensions are important for your success, you’ll definitely want to bookmark this one.

TechNet Gallery

J.C. Hornbeck | System Center Knowledge Engineer

The System Center Blog Aggregator app is now available on Android

J.C. Hornbeck — Tue, 10 May 2011 08:57:22 GMT

A few weeks back I announced the System Center Blog Aggregator app for Windows Phone 7 and today I wanted to let you know that it was now available for all you Android users out there as well. I won’t go into all the details as you can read that at the link above, but here are a couple screen shots to give you an idea of what it looks like. It’s essentially the same app except for the addition of the Nexus SC blog and the blog for Microsoft Server Application Virtualization. Look for the original Windows Phone 7 app to be updated shortly.

After you load and start The System Center Blog Aggregator you see the main screen that defaults to loading the Nexus SC System Center site:

From there you simply click the list button and you’ll see the option for all of our other blogs:

From there you can select and read any blog you like. So there you have it, an app that allows you to follow our content quickly and easily right on your Android phone. If you have an Android phone you should load up The System Center Blog Aggregator and check it out. It’s free after all so what do you have to lose? You can find it here.

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

Free 3 day Office 365 Jump Start Training Event

J.C. Hornbeck — Tue, 03 May 2011 06:47:47 GMT

I know this isn’t System Center Essentials specific but I thought you might want to know about a great training opportunity we have coming up at the end of the month for Office 365. On May 24th through 26th Microsoft Learning is hosting a free 3-day Jump Start tailored for IT Pros interested in learning more about preparing for and deploying Office 365. This is the first public training for IT Pros on Office 365. The course will be streamed live from 10:00-am-4:00pm PDT on all 3 days, and the recordings will be published later on TechNet Edge for later viewing.

We’ll deliver an overview of Office 365, Exchange Online, SharePoint Online, and Lync Online. Top subject matter experts for each technology will be delivering the content and you can find more info in this MSL blog post.

To get all the details, including the daily schedule, instructor bios and a registration link see the following:

https://www.eventbuilder.com/microsoft/event_desc.asp?p_event=x8f7i41r

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

A quick note on SCE 2010 support for Windows Server 2008 R2 SP1

J.C. Hornbeck — Mon, 18 Apr 2011 07:44:00 GMT

System Center Essentials 2010 (SCE 2010) is certified to work with Windows Server 2008 R2 SP1.

Important Note – SCE2010 will not be enhanced to support configuration of Dynamic Memory and Remote FX (new features that were added in Windows Server 2008 R2 SP1) on virtual machines, although SCE itself can run fine in a VM configured with dynamic memory. Therefore, if you want to use dynamic memory on a VM you must configure it directly from the Hyper-V Manager console. SCE can monitor and manage such VMs configured to use dynamic memory without problems. You simply won’t be able to make any changes in dynamic memory/Remote FX using the SCE console.

J.C. Hornbeck | System Center Knowledge Engineer

SCE Quick Fix: Designating a host that is in workgroup fails with error 2912 in System Center Essentials

J.C. Hornbeck — Tue, 01 Mar 2011 07:26:19 GMT

This is a repost of an article written by Milan Jajal that I put over on the Configuration Manager Support Team blog so if you follow that one you’ve probably already seen it. Back when I originally posted this I wasn’t part of the SCE blog family but now that I am I thought it would be nice if we had everything in one convenient place. Anyway, if you ever have the need to add a workgroup based host then this should get you going in the right direction.

Symptoms

You are using System Center Essentials (SCE) 2010 and you try to designate a host that is in a workgroup and not in a domain. The result is that it fails with the following error:

Error (2912)
An internal error has occurred trying to contact an agent on the server.

Recommended Action
Ensure the agent is installed and running. Ensure the WS-Management service is installed and running, then restart the agent.

Cause

This can occur when the host is not in the domain and instead is in a workgroup, causing the authentication between them to fail.

Note that the SCE console does not support the option of adding a host from perimeter network so you have to manually add the perimeter host using VMM Powershell available on SCE server.

Resolution

You can take the steps below to make this work:

1. Connect to the host computer via RDP, then from Control Panel –> Add/Remove programs, un-install the SCVMM 2008 R2 Agent (If already installed manually).

2. Using the source media for SCE, manually install the SCVMM 2008 R2 Agent from \setup\vmm\amd64\SetupVMM.exe. Select option to install a Local Agent.

3. In this wizard, select the option “This host is on a perimeter network” and specify a password for the Security file encryption key and do not select to use CA certificate.

4. Select Use Local computer name and click Next and Install.

5. This installs the SCVMM agent on that host. Note that you have to copy that SecurityFile.txt file from Host server to SCE server.

6. Now on the SCE server, open Start Menu –> Microsoft System Center –> Virtual Machine Manager 2008 R2 –> Windows Power Shell –> Virtual Machine Manager.

7. In the power shell run the commands below to add the host:

a. >Get-VMMServer -ComputerName "" - (This server connects to a SCE server which is an SCVMM server also).
b. >$Key = Get-Credential

This prompts for the user name and password. Specify user name as Administrator and the password as the same one you specified during the manual agent install.

c. >Add-VMHost "" -Description "Perimeter host" -RemoteConnectEnabled $False -PerimeterNetworkHost -SecurityFile "C:\temp\SecurityFile.txt" -EncryptionKey $Key - (Note: The location of security file is any location where you copied file from host to SCE server)

8. Now Host should get added fine.

9. You should eventually see the event below in the VM Manager event log on the SCE Server:

    Log Name:      VM Manager
    Source:        Virtual Machine Manager
    Date:
    Event ID:      1705
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:
    Description:
    Job 2bb6c79f-24de-4a9a-a279-036d72165b2e (Add perimeter network host) completed successfully.

10. Now in the SCE console you will see this computer as a host.

11. In the SCE console, below the All Virtual Machines view, you will now see all VMs hosted by this host.

12. While connecting to it, you may get prompted for credentials. After supplying the correct user name and password it may show one more prompt saying the certificate is not trusted.

13. From this prompt click on view certificate, go to the details tab, click on copy to file and export the certificate as .cer file.

14. From the SCE server –> MMC console –> Certificate snap-in, import this certificate under Trusted Root Certification Authorities.

15. Now exit and reopen the SCE console.

16. The SCE Console should be now able to see the host, all VMs and connect to all VMs fine.

More Information

“You can designate and configure servers as hosts for virtual machines in Essentials 2010 from the Essentials management server or from the Essentials console. You can also set up and manage the virtual machines on hosts in trusted domains, workgroups, or perimeter networks.”

You can find this in the Technet Library at this URL: http://technet.microsoft.com/en-us/library/ff603625.aspx

Hope this helps,

Milan Jajal | System Center Support Engineer

SCE 2007 Quick Fix: The admin console crashes when selecting a computer in the computers list

J.C. Hornbeck — Mon, 28 Feb 2011 07:37:59 GMT

I ran into an interesting issue the other day and thought I would post it here in case anyone else happened to see it. The issue is that if you use System Center Essentials 2007 (SCE) to manage computers in your environment, when you select a specific computer in the admin console it will try to display the information in the details pane but will ultimately crash with the error message below:

Description:
Stopped working

Problem signature:
Problem Event Name: CLR20r3
Problem Signature 01: B0JHPZQR1B3GGBEMYEIFSKRWRQLFYWDD
Problem Signature 02: 6.0.1885.0
Problem Signature 03: 47be30a3
Problem Signature 04: mscorlib
Problem Signature 05: 2.0.0.0
Problem Signature 06: 4bf4c743
Problem Signature 07: f4f
Problem Signature 08: 7
Problem Signature 09: N3CTRYE2KN3C34SGL4ZQYRBFTE4M13NB
OS Version: 6.0.6002.2.2.0.272.7
Locale ID: 1033

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

Note that selecting other computers works just fine, but whenever you select that problem computer the console will keep crashing while trying to display its information. Also when trying to run Reports for Deployment status, the reports will not work and will error out.

Cause

This can be caused by wrong information being reported by the video card driver. In this case, this happened because when SCE collected software and hardware inventory of that computer, the video card driver from that system reported an invalid value (e.g. a negative value) for the video card memory. For example, on a working computer it will show a value as 256 MB, but on a problem computer it may show a negative value such as -340473856 for Adapter RAM.

This can be seen by running Hardware Inventory report (SCE console –> Reporting pane) for that computer and selecting to see video card information.

Resolution

The ideal fix is to update the display driver on that computer or change it to a new one.

An alternate option is to update WSUS. This problem occurs when using WSUS 3.0 Service Pack 1 (3.1.6001.65) as it stores values in SUSDB as it's received (i.e. negative values), but in WSUS 3.0 Service Pack 2 (WSUS 3.2.7600.226), it takes care of such negative values and does not store the invalid values in SUSDB.

Once you update WSUS from SP1 to SP2, it updates SUSDB immediately, and then your SCE console will not crash anymore while trying to display information for that computer.

Reports for deployment status will also start working fine once this is done.

More Information

You can download WSUS 3.0 SP2 from this link: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a206ae20-2695-436c-9578-3403a7d46e40

Milan Jajal | System Center Support Engineer

How to install SCE 2007 SP1 which is blocked with expired WSUS 3.0 SP1 warning

Mangesh Sonar [MSFT] — Wed, 02 Feb 2011 02:47:25 GMT

The installation of SCE 2007 SP1 blocks with a warning “WSUS Valid Date”. This happens because the WSUS 3.0 SP1 image present on the SCE 2007 SP1 DVD is expired in October 2010. This blog lists the steps to download and install WSUS 3.0 SP2 to unblock and complete the installation of SCE 2007 SP1.

On running SetupSCE.exe from the SCE 2007 SP1 DVD, the installation of SCE stops on the prerequisites check page with the warning: “Current WSUS Version is Out of Date”. The NEXT option on the prerequisite check page is disabled (as shown in the screenshot below):

This happens because the WSUS 3.0 SP1 Present on the SCE 2007 SP1 DVD has expired and needs to be replaced with WSUS 3.0 SP2. The steps involved for downloading WSUS 3.0 SP2 and unblocking the installation of SCE 2007 SP1 are as follows:

1. Download the appropriate WSUS 3.0 SP2 package from the Knowledge Base Article: KB972455 at http://go.microsoft.com/fwlink/?LinkID=161140

2. Copy all the files from the SCE 2007 SP1 DVD onto a local folder on the machine, like C:\SCE 2007 SP1.

3. Replace the existing WSUS.exe in the Setup folder of SCE 2007 SP1 present in the local folder on the machine created in step 2 (C:\SCE 2007 SP1) with the WSUS3.0 SP2 KB article package downloaded in Step 1.

4. Run SetupSCE.exe from the SCE Setup present in the local folder on the machine created in Step 2.

5. The Installation Prerequisites page still shows the warning message “Current WSUS Version is out of date”. But the NEXT option is enabled and we can go ahead with the installation of SCE ignoring this warning message.

6. Proceed with the remaining pages on the SCE 2007 SP1 wizard to complete the installation of SCE 2007 SP1.

7. The version of WSUS installed is WSUS 3.0 SP2. This can be checked in the WSUS properties once the installation of SCE 2007 SP1 completes.

How to use the Fix Computer Group tool to rebuild computer groups deleted from Windows Server Update Services (WSUS)

M. Umair Aftab — Tue, 31 Aug 2010 17:19:01 GMT

When a computer group is created in Essentials 2010 using Create a Computer Group in the Computers space, a corresponding group is created in the WSUS database. This can be seen in the WSUS console.

Figure 1. Computer groups in the WSUS console.

Deleting these computer groups from the WSUS console will result in the computer group not showing in the Computers space.

Use this tool if you no longer see some or all computer groups in the Essentials console that you had previously created.

Running the Fix Computer Group tool

The Fix Computer Group tool must be run on the Essentials 2010 server.

To run this tool:

1. Open a Command Prompt window with Administrator rights.

2. Navigate to the Essentials 2010 installation directory.

3. Run LinkDG.exe.

The Fix Computer Group tool does not take any arguments. It will connect to the Essentials 2010 server and identify or fix any broken computer group relationships. The tool will display a list of completed tasks in the command prompt window after completion.

Figure 2. Default Essentials 2010 computer groups fixed.

Figure 3. Customized Essentials 2010 computer groups fixed.

How to use the Maintenance Mode Tool to schedule weekly maintenance modes for computer groups

GPAM — Mon, 23 Aug 2010 11:35:25 GMT

When a monitored object, such as a computer or distributed application, is taken offline for maintenance, Essentials 2010 detects that no agent heartbeat is being received and, as a result, might generate numerous alerts and notifications. To prevent alerts and notifications, monitored objects can be put into maintenance mode. When a monitored object is in maintenance mode, alerts, notifications, rules, monitors, automatic responses, state changes, and new alerts are suppressed at the agent.

Maintenance mode can only be initiated at the current time by manually selecting the object in the Actions pane of the Monitoring area in the console and clicking Start Maintenance Mode.

However, there may be users who need to schedule maintenance mode for some objects at a future recurring time. For example, a group of computers may need to be turned off every Saturday and Sunday night from 11PM for 3 hours. This tool will allow users to schedule a maintenance interval for computer groups, beginning at a certain time and lasting for certain duration on a weekly recurring basis. At the scheduled time on the scheduled days, all the computers in the specified computer group will be automatically put into maintenance mode for the specified duration.

The tool should only be run on the server where Essentials 2010 is installed. When the tool starts up, the user will see a table with a list of previously scheduled maintenance modes. Each maintenance mode will have the following attributes,

Computer Group: The computer group that the maintenance mode is scheduled for
Start Time: The time at which the maintenance mode is scheduled to start
Days of week: The days of the week on which maintenance occurs
Duration: The duration of the maintenance mode
Reason: The reason for the maintenance mode

The user can also hover over individual rows in the table to see a tooltip with the comments the user may have entered when creating the maintenance mode.

The New button lets a user schedule maintenance mode, the Delete button deletes a previously scheduled maintenance mode and the Close button closes the application. Note that the tool will not allow any editing of previously scheduled maintenance modes.

How to schedule a new maintenance interval for a computer group:

Click on the New button in the main window to show the “Schedule a new maintenance interval” window. In this window,

Select a computer group from the dropdown box (the list of computer groups is automatically populated). The list of computers in the selected computer group is shown in the list below the dropdown box.
Enter or pick a start time for the maintenance mode (time can be entered in either 12 hour or 24 hour formats)
Enter the duration of the maintenance mode in minutes. Note that the minimum duration is 5 minutes.
Pick the days of the week on which maintenance occurs
Pick the reason for maintenance mode from the dropdown box
Enter any additional comments in the comments textbox
Click the “Schedule” button

If the tool is able to successfully schedule maintenance mode, an appropriate message will be displayed.

If an error occurred when scheduling maintenance mode, an appropriate error message will be displayed. To close the “Schedule a new maintenance interval” window and return to the main screen, click the Close button.

It is recommended that you never put the Essentials management server into maintenance mode because configuration distribution, the heartbeat feature, and other features for the system might become unreliable. Hence the tool will never put the Essentials management server into maintenance mode even if it is part of the selected group.

How to delete a new maintenance interval for a computer group:

To delete a previously scheduled maintenance mode,

In the main program window, select the desired row in the table
Click the “Delete” button

A confirmation dialog box is shown. Click Yes to delete and No to cancel the deletion.