<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="https://www.w3.org/2005/Atom" xmlns:sy="https://purl.org/rss/1.0/modules/syndication/" xmlns:dc="https://purl.org/dc/elements/1.1/" xmlns:content="https://purl.org/rss/1.0/modules/content/" xmlns:wfw="https://wellformedweb.org/CommentAPI/" xmlns:slash="https://purl.org/rss/1.0/modules/slash/"
  version="2.0">
  <channel>
    <title>The Secure Infrastructure Guy</title>
    <atom:link
      href="https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/feed.xml"
      rel="self"
      type="application/rss+xml" />
    <link>https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/feed.xml</link>
    <description />
    <lastBuildDate>Tue, 16 Apr 2019 05:31:12 GMT</lastBuildDate>
    <language>en-US</language>
    <sy:updatePeriod>hourly</sy:updatePeriod>
    <sy:updateFrequency>1</sy:updateFrequency>
    <item>
      <title>System Center Configuration Manager 2012: Undocumented Features - Change collection default max display results</title>
      <link>https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/system-center-configuration-manager-2012-undocumented-features-change-collection-default-max-display-results</link>
      <pubDate>Thu, 17 Sep 2015 12:23:00 GMT</pubDate>
      <dc:creator><![CDATA[Christian Presley]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/17/system-center-configuration-manager-2012-undocumented-features-change-collection-default-max-display-results/</guid>
      <description><![CDATA[I was recently working with a customer that had a few thousand clients managed by Configuration...]]></description>
      <content:encoded><![CDATA[<p>I was recently working with a customer that had a few thousand clients managed by Configuration Manager, and they got tired of clicking the button to display more results past the default 1,000.</p>
<p>The good news is there is a built-in and supported way to accomplish this! It's just not documented anywhere.</p>
<ol>
<li>Go to the Collections node and click in the Search bar at the top</li>
<li>This will bring up a new tab on the ribbon named 'Search'</li>
<li>On the search tab, click 'Search Settings'<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/4718.SearchSettingsButton.png" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/4718.SearchSettingsButton.png"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/4718.SearchSettingsButton.png" original-url="https://blogs.msdn.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/4718.SearchSettingsButton.png" alt="" width="325" height="111" border="0" /></a></li>
<li>Change the value to what makes sense for your environment. Keep in mind, this has performance impacts for your local console.<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/2084.SearchSettingsDialog.png" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/2084.SearchSettingsDialog.png"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/2084.SearchSettingsDialog.png" original-url="https://blogs.msdn.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/2084.SearchSettingsDialog.png" alt="" width="239" height="124" border="0" /></a></li>
</ol>
<p>Now whenever you select a collection, it will by default display the number of clients or users that you've specified in the Search Settings.</p>
<p>This is on a per-console basis, so if you go to a different workstation, or re-install the SCCM console it will reset to the default 1,000 results.</p>]]></content:encoded>
    </item>
    <item>
      <title>Windows Server 2012 R2 WSUS Issue: Clients cause the WSUS App Pool to become unresponsive with HTTP 503</title>
      <link>https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/windows-server-2012-r2-wsus-issue-clients-cause-the-wsus-app-pool-to-become-unresponsive-with-http-503</link>
      <pubDate>Wed, 02 Sep 2015 13:59:00 GMT</pubDate>
      <dc:creator><![CDATA[Christian Presley]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/windows-server-2012-r2-wsus-issue-clients-cause-the-wsus-app-pool-to-become-unresponsive-with-http-503/</guid>
      <description><![CDATA[Something interesting that I recently uncovered while implementing WSUS with Windows Server 2012 R2...]]></description>
      <content:encoded><![CDATA[<p>Something interesting that I recently uncovered while implementing WSUS with Windows Server 2012 R2 as Software Update Points in Configuration Manager. The WSUS App Pool by default has relatively low Rapid-Fail Protection thresholds. These thresholds were causing the WSUS Web Service to eventually lock-out with HTTP 503.</p>
<p>The errors are associated with these events:</p>
<div><span style="font-size: x-small;">Log Name: Application</span><br /><span style="font-size: x-small;">Source: Windows Server Update Services</span><br /><span style="font-size: x-small;">Event ID: 12072</span></div>
<div><span style="font-size: x-small;">The WSUS content directory is not accessible.</span><br /><span style="font-size: x-small;">System.Net.WebException: The remote server returned an error: (503) Server Unavailable.</span><br /><span style="font-size: x-small;">&nbsp;&nbsp; at System.Net.HttpWebRequest.GetResponse()</span><br /><span style="font-size: x-small;">&nbsp;&nbsp; at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)</span></div>
<div>&nbsp;</div>
<div>
<div><span style="font-size: x-small;">Log Name: Application</span><br /><span style="font-size: x-small;">Source: SMS Server</span><br /><span style="font-size: x-small;">Event ID: 7000</span><br /><span style="font-size: x-small;">On 8/13/2015 3:22:40 AM, component SMS_WSUS_CONTROL_MANAGER on computer WSUS.fqdn reported:&nbsp; WSUS Control Manager failed to configure proxy settings on WSUS Server "WSUS.fqdn".</span></div>
<div><span style="font-size: x-small;">Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.</span><br /><span style="font-size: x-small;">Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid.</span></div>
</div>
<div>&nbsp;</div>
<div><span style="font-size: x-small;">Log Name: System</span></div>
<div><span style="font-size: x-small;">Source: Microsoft-Windows-WAS</span></div>
<div><span style="font-size: x-small;">Event ID: 5074</span></div>
<div><span style="font-size: x-small;">A worker process with process id of '%1' serving application pool '%2' has requested a recycle because the worker process reached its allowed processing time limit.</span><span style="font-size: x-small;"><br /></span></div>
<p>Increasing the thresholds from default was necessary to maintain the service. Here's what I found to work in a customers production environment:</p>
<ol>
<li>On your WSUS Server, launch the IIS Manager</li>
<li>Open Application Pools</li>
<li>Right click 'WsusPool' and select 'Advanced Settings...'</li>
<li>To support the maximum SCCM Software Update Point clients, change 'Queue Length' from the default 1,000 to 25,000<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/4401.WsusPool_Top.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/4401.WsusPool_5F00_Top.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/4401.WsusPool_Top.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/300x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/4401.WsusPool_5F00_Top.PNG" alt="" border="0" /></a></li>
<li>If your server is NUMA aware, change 'Maximum Worker Processes' from the default 1 to 0. If you don't know if your server is NUMA aware, leave this value default<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/7215.WsusPool_Mid.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/7215.WsusPool_5F00_Mid.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/7215.WsusPool_Mid.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/300x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/7215.WsusPool_5F00_Mid.PNG" alt="" border="0" /></a></li>
<li>Change '"Service Unavailable" Response Type' from the default HttpLevel to TcpLevel</li>
<li>Change 'Failure Interval (minutes) from the default 5 to 30</li>
<li>Change 'Maximum Failures' from the default 5 to 60<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/6266.WsusPool_Bot.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/6266.WsusPool_5F00_Bot.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/6266.WsusPool_Bot.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/300x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/6266.WsusPool_5F00_Bot.PNG" alt="" border="0" /></a></li>
<li>Click 'OK' to save the App Pool changes</li>
<li>From an administrative command prompt, type IISRESET</li>
</ol>
<p>Your clients should now be able to check-in to the Software Update Point / WSUS service.</p>]]></content:encoded>
    </item>
    <item>
      <title>Hardware Inventory Issue: Top Level group not found.</title>
      <link>https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/hardware-inventory-issue-top-level-group-not-found</link>
      <pubDate>Wed, 02 Sep 2015 12:33:00 GMT</pubDate>
      <dc:creator><![CDATA[Christian Presley]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/hardware-inventory-issue-top-level-group-not-found/</guid>
      <description><![CDATA[&nbsp;
If you've spent any time with Configuration Manager Hardware Inventory, you know that it can...]]></description>
      <content:encoded><![CDATA[<p>&nbsp;</p>
<p>If you've spent any time with Configuration Manager Hardware Inventory, you know that it can be a little bit finicky and prone to failure if not configured correctly. I'm going to describe a fix that I implemented for a customer recently&nbsp;where&nbsp;the Inventory data loader (located at &lt;ConfigMgr Installation Directory\Logs\dataldr.log) reports the following error:</p>
<p><em>CMachineSource::InsertMachine - Top Level group not found.&nbsp; All MIFs require a group that is the same name as the architecture.</em></p>
<p>And the MIF files from clients will be moved to &lt;ConfigMgr Installation Directory&gt;\inboxes\auth\dataldr.box\BADMIFS\NonExistentRow</p>
<p>Steve Rachui has a great and very in-depth blog article located here: <br />https://blogs.msdn.com/b/steverac/archive/2010/11/22/the-case-of-the-mif-and-wmi-repository.aspx</p>
<p>&nbsp;</p>
<p>In every case I have discovered, the only way to recover from this specific error is to re-install the SCCM client agent. The primary reason for this behavior is because the initial inventory MIF is supposed to create a row in GS_WORKSTATION_STATUS, and if you misconfigure hardware inventory, it could prevent the hardware inventory from adding this row, which will prevent all future inventory data coming from that client, and even triggering a "Full Hardware Inventory Sync" will not create the row.</p>
<p>Starting with Configuration Manager 2012 SP1, we added the /forceinstall parameter to ccmsetup.exe. Basically, what this parameter does is tell the existing ConfigMgr client agent to <em>uninstall first</em> and then install the client. This is very important, because simply installing the client over the top of the already installed ConfigMgr client will not actually fix the issue. Steve does a great job identifying why the client behaves that way, and he also suggests uninstalling/reinstalling the client.</p>
<p>Here is the process that I've created to successfully uninstall and reinstall the client agent, and I have verified on several hundred clients that this works. The best part is that you can deploy this through ConfigMgr packages and maintain the deployment history!</p>
<ol>
<li>Configure a new Package in SCCM. Software Library &gt; Application Management &gt; Packages</li>
<li>Right click Packages and click Create Package</li>
<li>Name the package "Reinstall ConfigMgr Client" and leave "This package contains source files" unchecked. Click Next<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/1385.New%20Package.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/1385.New-Package.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/1385.New%20Package.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/450x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/1385.New-Package.PNG" alt="" border="0" /></a></li>
<li>Leave the 'Standard Program' radio box selected and click Next<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/8182.New%20Program.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/8182.New-Program.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/8182.New%20Program.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/450x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/8182.New-Program.PNG" alt="" border="0" /></a></li>
<li>Name the program "Reinstall ConfigMgr Client" and change 'Run: to Hidden' and 'Program can run: to Whether or not a user is logged on' and click Next<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/6646.Program%20Information.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/6646.Program-Information.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/6646.Program%20Information.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/450x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/6646.Program-Information.PNG" alt="" border="0" /></a></li>
<li>A good recommendation practice is to change the Program Requirements 'Estimated disk space' to 150MB just in case the client has run out of space on the OS drive<br /><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/7356.Program%20Requirements.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/7356.Program-Requirements.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/7356.Program%20Requirements.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/450x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/7356.Program-Requirements.PNG" alt="" border="0" /></a></li>
</ol>
<p>For reference here is the command line that I've used to successfully performed this task:</p>
<p>%WinDir%\ccmsetup\ccmsetup.exe /forceinstall /mp:&lt;Management Point FQDN&gt; SMSSITECODE=XYZ SMSMP=&lt;Management Point FQDN&gt; FSP=&lt;Fallback Status Point FQDN&gt; DNSSUFFIX=&lt;Domain DNS Suffix&gt; SMSCONFIGSOURCE=P</p>
<p>Once you have created this package, you should double check that "Source content" is still unchecked. Right click the 'Reinstall ConfigMgr Client' package and click the 'Data Source' tab. At the top uncheck the 'This package contains source files'. I'm not sure why this checkbox misbehaves, but I've seen it not respect what you've chosen in the Create Package wizard.</p>
<p>Deploy this package to the clients that need their hardware inventory remediated. If you're going to do this on hundreds of clients, I would recommend phasing the deployment to 10% chunks of total clients to be remediated so as to prevent backlogging.</p>
<p>From this point, the initial hardware inventory will trigger automatically.</p>]]></content:encoded>
    </item>
    <item>
      <title>Deploying Custom Hardware Inventory in ConfigMgr 2012 R2</title>
      <link>https://docs.microsoft.com/archive/blogs/the_secure_infrastructure_guy/deploying-custom-hardware-inventory-in-configmgr-2012-r2</link>
      <pubDate>Wed, 02 Sep 2015 10:57:00 GMT</pubDate>
      <dc:creator><![CDATA[Christian Presley]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/deploying-custom-hardware-inventory-in-configmgr-2012-r2/</guid>
      <description><![CDATA[Part of maintaining a secure environment is to understand the membership of your local groups,...]]></description>
      <content:encoded><![CDATA[<p>Part of maintaining a secure environment is to understand the membership of your local groups, primarily Administrators. Something that is becoming more common for this is to use Configuration Manager Hardware Inventory to discover memberships across your environment.</p>
<p>I won't get into the details of actually configuring the custom inventory, but I can say it involves creating a new WMI class and adding that to your inventory policy. The best way to perform that is to use baseline configurations, but let's say there are clients that don't create this new class. You will get errors for those clients, and they may stop performing hardware inventory altogether, which could cause backlogging.</p>
<p>When you do this custom hardware inventory, it's very important to target the inventory policy to the clients with the custom WMI classes. If you're using baseline configurations as in my example, you can easily create a dynamic query to add those members, and then deploy the Client Settings to that collection.</p>
<p>Here's the query for my specific baseline. As you can see, I've filtered it to Client Installed = 1, the Baseline scope ID, and finally Compliance State = 1.</p>
<p><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/5287.Baseline%20Query.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/5287.Baseline-Query.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/5287.Baseline%20Query.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/5287.Baseline-Query.PNG" alt="" border="0" /></a></p>
<p>&nbsp;</p>
<p>Here is an example of a new Client Settings policy specific to Hardware Inventory Local Groups.</p>
<p><a href="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/3531.Client%20Settings.PNG" original-url="https://blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/3531.Client-Settings.PNG"><img src="https://msdnshared.blob.core.windows.net/media/MSDNBlogsFS/prod.evol.blogs.msdn.com/CommunityServer.Blogs.Components.WeblogFiles/00/00/01/72/49/3531.Client%20Settings.PNG" original-url="https://blogs.msdn.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-01-72-49/3531.Client-Settings.PNG" alt="" border="0" /></a></p>
<p>Now all you need to do is deploy this Client Settings policy to the dynamic collection and you'll be golden!</p>]]></content:encoded>
    </item>
  </channel>
</rss>